chore: spelling

Signed-off-by: Xe Iaso <me@xeiaso.net>

.github/actions/spelling/allow.txt

@@ -3,5 +3,4 @@ https
 ssh
 ubuntu
 workarounds
-rjack
-msgbox
+rjack

.github/actions/spelling/patterns.txt

@@ -132,7 +132,3 @@ go install(?:\s+[a-z]+\.[-@\w/.]+)+
 # hit-count: 1 file-count: 1
 # microsoft
 \b(?:https?://|)(?:(?:(?:blogs|download\.visualstudio|docs|msdn2?|research)\.|)microsoft|blogs\.msdn)\.co(?:m|\.\w\w)/[-_a-zA-Z0-9()=./%]*
-
-# hit-count: 1 file-count: 1
-# data url
-\bdata:[-a-zA-Z=;:/0-9+]*,\S*

VERSION

@@ -1 +1 @@
-1.21.3
+1.21.1

cmd/anubis/main.go

@@ -30,11 +30,10 @@ import (
 	"github.com/TecharoHQ/anubis"
 	"github.com/TecharoHQ/anubis/data"
 	"github.com/TecharoHQ/anubis/internal"
+	"github.com/TecharoHQ/anubis/internal/thoth"
 	libanubis "github.com/TecharoHQ/anubis/lib"
-	"github.com/TecharoHQ/anubis/lib/checker/headerexists"
 	botPolicy "github.com/TecharoHQ/anubis/lib/policy"
 	"github.com/TecharoHQ/anubis/lib/policy/config"
-	"github.com/TecharoHQ/anubis/lib/thoth"
 	"github.com/TecharoHQ/anubis/web"
 	"github.com/facebookgo/flagenv"
 	_ "github.com/joho/godotenv/autoload"
@@ -324,7 +323,7 @@ func main() {
 	if *debugBenchmarkJS {
 		policy.Bots = []botPolicy.Bot{{
 			Name:   "",
-			Rules:  headerexists.New("User-Agent"),
+			Rules:  botPolicy.NewHeaderExistsChecker("User-Agent"),
 			Action: config.RuleBenchmark,
 		}}
 	}

cmd/robots2policy/main.go

@@ -12,7 +12,6 @@ import (
 	"regexp"
 	"strings"
 
-	"github.com/TecharoHQ/anubis/lib/checker/expression"
 	"github.com/TecharoHQ/anubis/lib/policy/config"
 
 	"sigs.k8s.io/yaml"
@@ -38,11 +37,11 @@ type RobotsRule struct {
 }
 
 type AnubisRule struct {
-	Expression *expression.Config     `yaml:"expression,omitempty" json:"expression,omitempty"`
-	Challenge  *config.ChallengeRules `yaml:"challenge,omitempty" json:"challenge,omitempty"`
-	Weight     *config.Weight         `yaml:"weight,omitempty" json:"weight,omitempty"`
-	Name       string                 `yaml:"name" json:"name"`
-	Action     string                 `yaml:"action" json:"action"`
+	Expression *config.ExpressionOrList `yaml:"expression,omitempty" json:"expression,omitempty"`
+	Challenge  *config.ChallengeRules   `yaml:"challenge,omitempty" json:"challenge,omitempty"`
+	Weight     *config.Weight           `yaml:"weight,omitempty" json:"weight,omitempty"`
+	Name       string                   `yaml:"name" json:"name"`
+	Action     string                   `yaml:"action" json:"action"`
 }
 
 func init() {
@@ -225,11 +224,11 @@ func convertToAnubisRules(robotsRules []RobotsRule) []AnubisRule {
 			}
 
 			if userAgent == "*" {
-				rule.Expression = &expression.Config{
+				rule.Expression = &config.ExpressionOrList{
 					All: []string{"true"}, // Always applies
 				}
 			} else {
-				rule.Expression = &expression.Config{
+				rule.Expression = &config.ExpressionOrList{
 					All: []string{fmt.Sprintf("userAgent.contains(%q)", userAgent)},
 				}
 			}
@@ -250,11 +249,11 @@ func convertToAnubisRules(robotsRules []RobotsRule) []AnubisRule {
 				rule.Name = fmt.Sprintf("%s-global-restriction-%d", *policyName, ruleCounter)
 				rule.Action = "WEIGH"
 				rule.Weight = &config.Weight{Adjust: 20} // Increase difficulty significantly
-				rule.Expression = &expression.Config{
+				rule.Expression = &config.ExpressionOrList{
 					All: []string{"true"}, // Always applies
 				}
 			} else {
-				rule.Expression = &expression.Config{
+				rule.Expression = &config.ExpressionOrList{
 					All: []string{fmt.Sprintf("userAgent.contains(%q)", userAgent)},
 				}
 			}
@@ -286,7 +285,7 @@ func convertToAnubisRules(robotsRules []RobotsRule) []AnubisRule {
 			pathCondition := buildPathCondition(disallow)
 			conditions = append(conditions, pathCondition)
 
-			rule.Expression = &expression.Config{
+			rule.Expression = &config.ExpressionOrList{
 				All: conditions,
 			}
 

docs/docs/CHANGELOG.md

@@ -13,26 +13,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- This changes the project to: -->
 
-- The [Thoth client](https://anubis.techaro.lol/docs/admin/thoth) is now public in the repo instead of being an internal package.
-
-## v1.21.3: Minfilia Warde - Echo 3
-
-### Fixes
-
-#### Fixes a problem with nonstandard URLs and redirects
-
-Fixes [GHSA-jhjj-2g64-px7c](https://github.com/TecharoHQ/anubis/security/advisories/GHSA-jhjj-2g64-px7c).
-
-This could allow an attacker to craft an Anubis pass-challenge URL that forces a redirect to nonstandard URLs, such as the `javascript:` scheme which executes arbitrary JavaScript code in a browser context when the user clicks the "Try again" button.
-
-This has been fixed by disallowing any URLs without the scheme `http` or `https`.
-
-Additionally, the "Try again" button has been fixed to completely ignore the user-supplied redirect location. It now redirects to the home page (`/`).
-
-## v1.21.2: Minfilia Warde - Echo 2
-
-This contained an incomplete fix for [GHSA-jhjj-2g64-px7c](https://github.com/TecharoHQ/anubis/security/advisories/GHSA-jhjj-2g64-px7c). Do not use this version.
-
 ## v1.21.1: Minfilia Warde - Echo 1
 
 - Expired records are now properly removed from bbolt databases ([#848](https://github.com/TecharoHQ/anubis/pull/848)).

docs/package-lock.json

@@ -5908,9 +5908,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
+      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0",
@@ -6496,16 +6496,16 @@
       }
     },
     "node_modules/compression": {
-      "version": "1.8.1",
-      "resolved": "https://registry.npmjs.org/compression/-/compression-1.8.1.tgz",
-      "integrity": "sha512-9mAqGPHLakhCLeNyxPkK4xVo746zQ/czLH1Ky+vkitMnWfWZps8r0qXuwhwizagCRttsL4lfG4pIOvaWLpAP0w==",
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/compression/-/compression-1.8.0.tgz",
+      "integrity": "sha512-k6WLKfunuqCYD3t6AsuPGvQWaKwuLLh2/xHNcX4qE+vIfDNXpSqnrhwA7O53R7WVQUnt8dVAIW+YHr7xTgOgGA==",
       "license": "MIT",
       "dependencies": {
         "bytes": "3.1.2",
         "compressible": "~2.0.18",
         "debug": "2.6.9",
         "negotiator": "~0.6.4",
-        "on-headers": "~1.1.0",
+        "on-headers": "~1.0.2",
         "safe-buffer": "5.2.1",
         "vary": "~1.1.2"
       },
@@ -13562,9 +13562,9 @@
       }
     },
     "node_modules/on-headers": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/on-headers/-/on-headers-1.1.0.tgz",
-      "integrity": "sha512-737ZY3yNnXy37FHkQxPzt4UZ2UWPWiCZWLvFZ4fu5cueciegX0zGPnrlY6bwRg4FdQOe9YU8MkmJwGhoMybl8A==",
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/on-headers/-/on-headers-1.0.2.tgz",
+      "integrity": "sha512-pZAE+FJLoyITytdqK0U5s+FIpjN0JP3OzFi/u8Rx+EV5/W+JTWGXG8xFzevE7AjBfDqHv/8vL8qQsIhHnqRkrA==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.8"

errors.go

@@ -1,7 +0,0 @@
-package anubis
-
-import "errors"
-
-var (
-	ErrMisconfiguration = errors.New("[unexpected] policy: administrator misconfiguration")
-)

internal/thoth/asnchecker.go

@@ -10,11 +10,11 @@ import (
 	"time"
 
 	"github.com/TecharoHQ/anubis/internal"
-	"github.com/TecharoHQ/anubis/lib/checker"
+	"github.com/TecharoHQ/anubis/lib/policy/checker"
 	iptoasnv1 "github.com/TecharoHQ/thoth-proto/gen/techaro/thoth/iptoasn/v1"
 )
 
-func (c *Client) ASNCheckerFor(asns []uint32) checker.Interface {
+func (c *Client) ASNCheckerFor(asns []uint32) checker.Impl {
 	asnMap := map[uint32]struct{}{}
 	var sb strings.Builder
 	fmt.Fprintln(&sb, "ASNChecker")

internal/thoth/asnchecker_test.go

@@ -5,12 +5,12 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	"github.com/TecharoHQ/anubis/lib/checker"
-	"github.com/TecharoHQ/anubis/lib/thoth"
+	"github.com/TecharoHQ/anubis/internal/thoth"
+	"github.com/TecharoHQ/anubis/lib/policy/checker"
 	iptoasnv1 "github.com/TecharoHQ/thoth-proto/gen/techaro/thoth/iptoasn/v1"
 )
 
-var _ checker.Interface = &thoth.ASNChecker{}
+var _ checker.Impl = &thoth.ASNChecker{}
 
 func TestASNChecker(t *testing.T) {
 	cli := loadSecrets(t)

internal/thoth/geoipchecker.go

@@ -9,11 +9,11 @@ import (
 	"strings"
 	"time"
 
-	"github.com/TecharoHQ/anubis/lib/checker"
+	"github.com/TecharoHQ/anubis/lib/policy/checker"
 	iptoasnv1 "github.com/TecharoHQ/thoth-proto/gen/techaro/thoth/iptoasn/v1"
 )
 
-func (c *Client) GeoIPCheckerFor(countries []string) checker.Interface {
+func (c *Client) GeoIPCheckerFor(countries []string) checker.Impl {
 	countryMap := map[string]struct{}{}
 	var sb strings.Builder
 	fmt.Fprintln(&sb, "GeoIPChecker")

internal/thoth/geoipchecker_test.go

@@ -5,11 +5,11 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	"github.com/TecharoHQ/anubis/lib/checker"
-	"github.com/TecharoHQ/anubis/lib/thoth"
+	"github.com/TecharoHQ/anubis/internal/thoth"
+	"github.com/TecharoHQ/anubis/lib/policy/checker"
 )
 
-var _ checker.Interface = &thoth.GeoIPChecker{}
+var _ checker.Impl = &thoth.GeoIPChecker{}
 
 func TestGeoIPChecker(t *testing.T) {
 	cli := loadSecrets(t)

internal/thoth/thoth_test.go

@@ -4,8 +4,8 @@ import (
 	"os"
 	"testing"
 
-	"github.com/TecharoHQ/anubis/lib/thoth"
-	"github.com/TecharoHQ/anubis/lib/thoth/thothmock"
+	"github.com/TecharoHQ/anubis/internal/thoth"
+	"github.com/TecharoHQ/anubis/internal/thoth/thothmock"
 	"github.com/joho/godotenv"
 )
 

internal/thoth/thothmock/withthothmock.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"testing"
 
-	"github.com/TecharoHQ/anubis/lib/thoth"
+	"github.com/TecharoHQ/anubis/internal/thoth"
 )
 
 func WithMockThoth(t *testing.T) context.Context {

lib/anubis.go

@@ -28,17 +28,15 @@ import (
 	"github.com/TecharoHQ/anubis/internal/dnsbl"
 	"github.com/TecharoHQ/anubis/internal/ogtags"
 	"github.com/TecharoHQ/anubis/lib/challenge"
-	"github.com/TecharoHQ/anubis/lib/checker"
 	"github.com/TecharoHQ/anubis/lib/localization"
 	"github.com/TecharoHQ/anubis/lib/policy"
+	"github.com/TecharoHQ/anubis/lib/policy/checker"
 	"github.com/TecharoHQ/anubis/lib/policy/config"
 	"github.com/TecharoHQ/anubis/lib/store"
 
-	// checker implementations
-	_ "github.com/TecharoHQ/anubis/lib/checker/all"
-
 	// challenge implementations
-	_ "github.com/TecharoHQ/anubis/lib/challenge/all"
+	_ "github.com/TecharoHQ/anubis/lib/challenge/metarefresh"
+	_ "github.com/TecharoHQ/anubis/lib/challenge/proofofwork"
 )
 
 var (
@@ -386,23 +384,6 @@ func (s *Server) PassChallenge(w http.ResponseWriter, r *http.Request) {
 	lg := internal.GetRequestLogger(r)
 	localizer := localization.GetLocalizer(r)
 
-	redir := r.FormValue("redir")
-	redirURL, err := url.ParseRequestURI(redir)
-	if err != nil {
-		lg.Error("invalid redirect", "err", err)
-		s.respondWithStatus(w, r, localizer.T("invalid_redirect"), http.StatusBadRequest)
-		return
-	}
-
-	switch redirURL.Scheme {
-	case "", "http", "https":
-		// allowed
-	default:
-		lg.Error("XSS attempt blocked, invalid redirect scheme", "scheme", redirURL.Scheme)
-		s.respondWithStatus(w, r, localizer.T("invalid_redirect"), http.StatusBadRequest)
-		return
-	}
-
 	// Adjust cookie path if base prefix is not empty
 	cookiePath := "/"
 	if anubis.BasePrefix != "" {
@@ -417,6 +398,13 @@ func (s *Server) PassChallenge(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	redir := r.FormValue("redir")
+	redirURL, err := url.ParseRequestURI(redir)
+	if err != nil {
+		lg.Error("invalid redirect", "err", err)
+		s.respondWithError(w, r, localizer.T("invalid_redirect"))
+		return
+	}
 	// used by the path checker rule
 	r.URL = redirURL
 
@@ -551,7 +539,7 @@ func (s *Server) check(r *http.Request) (policy.CheckResult, *policy.Bot, error)
 		if matches {
 			return cr("threshold/"+t.Name, t.Action, weight), &policy.Bot{
 				Challenge: t.Challenge,
-				Rules:     &checker.Any{},
+				Rules:     &checker.List{},
 			}, nil
 		}
 	}
@@ -562,6 +550,6 @@ func (s *Server) check(r *http.Request) (policy.CheckResult, *policy.Bot, error)
 			ReportAs:   s.policy.DefaultDifficulty,
 			Algorithm:  config.DefaultAlgorithm,
 		},
-		Rules: &checker.Any{},
+		Rules: &checker.List{},
 	}, nil
 }

lib/anubis_test.go

@@ -1,7 +1,6 @@
 package lib
 
 import (
-	"bytes"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -17,9 +16,9 @@ import (
 	"github.com/TecharoHQ/anubis"
 	"github.com/TecharoHQ/anubis/data"
 	"github.com/TecharoHQ/anubis/internal"
+	"github.com/TecharoHQ/anubis/internal/thoth/thothmock"
 	"github.com/TecharoHQ/anubis/lib/policy"
 	"github.com/TecharoHQ/anubis/lib/policy/config"
-	"github.com/TecharoHQ/anubis/lib/thoth/thothmock"
 )
 
 func init() {
@@ -802,166 +801,3 @@ func TestChallengeFor_ErrNotFound(t *testing.T) {
 		}
 	})
 }
-
-func TestPassChallengeXSS(t *testing.T) {
-	pol := loadPolicies(t, "", anubis.DefaultDifficulty)
-
-	srv := spawnAnubis(t, Options{
-		Next:   http.NewServeMux(),
-		Policy: pol,
-	})
-
-	ts := httptest.NewServer(internal.RemoteXRealIP(true, "tcp", srv))
-	defer ts.Close()
-
-	cli := httpClient(t)
-	chall := makeChallenge(t, ts, cli)
-
-	testCases := []struct {
-		name  string
-		redir string
-	}{
-		{
-			name:  "javascript alert",
-			redir: "javascript:alert('xss')",
-		},
-		{
-			name:  "vbscript",
-			redir: "vbscript:msgbox(\"XSS\")",
-		},
-		{
-			name:  "data url",
-			redir: "data:text/html;base64,PHNjcmlwdD5hbGVydCgneHNzJyk8L3NjcmlwdD4=",
-		},
-	}
-
-	t.Run("with test cookie", func(t *testing.T) {
-		for _, tc := range testCases {
-			t.Run(tc.name, func(t *testing.T) {
-				nonce := 0
-				elapsedTime := 420
-				calculated := ""
-				calcString := fmt.Sprintf("%s%d", chall.Challenge, nonce)
-				calculated = internal.SHA256sum(calcString)
-
-				req, err := http.NewRequest(http.MethodGet, ts.URL+"/.within.website/x/cmd/anubis/api/pass-challenge", nil)
-				if err != nil {
-					t.Fatalf("can't make request: %v", err)
-				}
-
-				q := req.URL.Query()
-				q.Set("response", calculated)
-				q.Set("nonce", fmt.Sprint(nonce))
-				q.Set("redir", tc.redir)
-				q.Set("elapsedTime", fmt.Sprint(elapsedTime))
-				req.URL.RawQuery = q.Encode()
-
-				u, err := url.Parse(ts.URL)
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				for _, ckie := range cli.Jar.Cookies(u) {
-					if ckie.Name == anubis.TestCookieName {
-						req.AddCookie(ckie)
-					}
-				}
-
-				resp, err := cli.Do(req)
-				if err != nil {
-					t.Fatalf("can't do request: %v", err)
-				}
-
-				body, _ := io.ReadAll(resp.Body)
-
-				if bytes.Contains(body, []byte(tc.redir)) {
-					t.Log(string(body))
-					t.Error("found XSS in HTML body")
-				}
-
-				if resp.StatusCode != http.StatusBadRequest {
-					t.Errorf("wanted status %d, got %d. body: %s", http.StatusBadRequest, resp.StatusCode, body)
-				}
-			})
-		}
-	})
-
-	t.Run("no test cookie", func(t *testing.T) {
-		for _, tc := range testCases {
-			t.Run(tc.name, func(t *testing.T) {
-				nonce := 0
-				elapsedTime := 420
-				calculated := ""
-				calcString := fmt.Sprintf("%s%d", chall.Challenge, nonce)
-				calculated = internal.SHA256sum(calcString)
-
-				req, err := http.NewRequest(http.MethodGet, ts.URL+"/.within.website/x/cmd/anubis/api/pass-challenge", nil)
-				if err != nil {
-					t.Fatalf("can't make request: %v", err)
-				}
-
-				q := req.URL.Query()
-				q.Set("response", calculated)
-				q.Set("nonce", fmt.Sprint(nonce))
-				q.Set("redir", tc.redir)
-				q.Set("elapsedTime", fmt.Sprint(elapsedTime))
-				req.URL.RawQuery = q.Encode()
-
-				resp, err := cli.Do(req)
-				if err != nil {
-					t.Fatalf("can't do request: %v", err)
-				}
-
-				body, _ := io.ReadAll(resp.Body)
-
-				if bytes.Contains(body, []byte(tc.redir)) {
-					t.Log(string(body))
-					t.Error("found XSS in HTML body")
-				}
-
-				if resp.StatusCode != http.StatusBadRequest {
-					t.Errorf("wanted status %d, got %d. body: %s", http.StatusBadRequest, resp.StatusCode, body)
-				}
-			})
-		}
-	})
-}
-
-func TestXForwardedForNoDoubleComma(t *testing.T) {
-	var h http.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("X-Forwarded-For", r.Header.Get("X-Forwarded-For"))
-		fmt.Fprintln(w, "OK")
-	})
-
-	h = internal.XForwardedForToXRealIP(h)
-	h = internal.XForwardedForUpdate(false, h)
-
-	pol := loadPolicies(t, "testdata/permissive.yaml", 4)
-
-	srv := spawnAnubis(t, Options{
-		Next:   h,
-		Policy: pol,
-	})
-	ts := httptest.NewServer(srv)
-	t.Cleanup(ts.Close)
-
-	req, err := http.NewRequest(http.MethodGet, ts.URL, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	req.Header.Set("X-Real-Ip", "10.0.0.1")
-
-	resp, err := ts.Client().Do(req)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if resp.StatusCode != http.StatusOK {
-		t.Errorf("response status is wrong, wanted %d but got: %s", http.StatusOK, resp.Status)
-	}
-
-	if xff := resp.Header.Get("X-Forwarded-For"); strings.HasPrefix(xff, ",,") {
-		t.Errorf("X-Forwarded-For has two leading commas: %q", xff)
-	}
-}

lib/challenge/all/all.go

@@ -1,6 +0,0 @@
-package all
-
-import (
-	_ "github.com/TecharoHQ/anubis/lib/challenge/metarefresh"
-	_ "github.com/TecharoHQ/anubis/lib/challenge/proofofwork"
-)

lib/checker/all.go

@@ -1,35 +0,0 @@
-package checker
-
-import (
-	"fmt"
-	"net/http"
-	"strings"
-
-	"github.com/TecharoHQ/anubis/internal"
-)
-
-type All []Interface
-
-func (a All) Check(r *http.Request) (bool, error) {
-	for _, c := range a {
-		match, err := c.Check(r)
-		if err != nil {
-			return match, err
-		}
-		if !match {
-			return false, err // no match
-		}
-	}
-
-	return true, nil // match
-}
-
-func (a All) Hash() string {
-	var sb strings.Builder
-
-	for _, c := range a {
-		fmt.Fprintln(&sb, c.Hash())
-	}
-
-	return internal.FastHash(sb.String())
-}

lib/checker/all/all.go

@@ -1,10 +0,0 @@
-// Package all imports all of the standard checker types.
-package all
-
-import (
-	_ "github.com/TecharoHQ/anubis/lib/checker/expression"
-	_ "github.com/TecharoHQ/anubis/lib/checker/headerexists"
-	_ "github.com/TecharoHQ/anubis/lib/checker/headermatches"
-	_ "github.com/TecharoHQ/anubis/lib/checker/path"
-	_ "github.com/TecharoHQ/anubis/lib/checker/remoteaddress"
-)

lib/checker/all_test.go

@@ -1,70 +0,0 @@
-package checker
-
-import (
-	"net/http"
-	"testing"
-)
-
-func TestAll_Check(t *testing.T) {
-	tests := []struct {
-		name     string
-		checkers []MockChecker
-		want     bool
-		wantErr  bool
-	}{
-		{
-			name: "All match",
-			checkers: []MockChecker{
-				{Result: true, Err: nil},
-				{Result: true, Err: nil},
-			},
-			want:    true,
-			wantErr: false,
-		},
-		{
-			name: "One not match",
-			checkers: []MockChecker{
-				{Result: true, Err: nil},
-				{Result: false, Err: nil},
-			},
-			want:    false,
-			wantErr: false,
-		},
-		{
-			name: "No match",
-			checkers: []MockChecker{
-				{Result: false, Err: nil},
-				{Result: false, Err: nil},
-			},
-			want:    false,
-			wantErr: false,
-		},
-		{
-			name: "Error encountered",
-			checkers: []MockChecker{
-				{Result: true, Err: nil},
-				{Result: false, Err: http.ErrNotSupported},
-			},
-			want:    false,
-			wantErr: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			var all All
-			for _, mc := range tt.checkers {
-				all = append(all, mc)
-			}
-
-			got, err := all.Check(nil)
-			if (err != nil) != tt.wantErr {
-				t.Errorf("All.Check() error = %v, wantErr %v", err, tt.wantErr)
-				return
-			}
-			if got != tt.want {
-				t.Errorf("All.Check() = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}

lib/checker/any.go

@@ -1,35 +0,0 @@
-package checker
-
-import (
-	"fmt"
-	"net/http"
-	"strings"
-
-	"github.com/TecharoHQ/anubis/internal"
-)
-
-type Any []Interface
-
-func (a Any) Check(r *http.Request) (bool, error) {
-	for _, c := range a {
-		match, err := c.Check(r)
-		if err != nil {
-			return match, err
-		}
-		if match {
-			return true, err // match
-		}
-	}
-
-	return false, nil // no match
-}
-
-func (a Any) Hash() string {
-	var sb strings.Builder
-
-	for _, c := range a {
-		fmt.Fprintln(&sb, c.Hash())
-	}
-
-	return internal.FastHash(sb.String())
-}

lib/checker/any_test.go

@@ -1,83 +0,0 @@
-package checker
-
-import (
-	"net/http"
-	"testing"
-)
-
-type MockChecker struct {
-	Result bool
-	Err    error
-}
-
-func (m MockChecker) Check(r *http.Request) (bool, error) {
-	return m.Result, m.Err
-}
-
-func (m MockChecker) Hash() string {
-	return "mock-hash"
-}
-
-func TestAny_Check(t *testing.T) {
-	tests := []struct {
-		name     string
-		checkers []MockChecker
-		want     bool
-		wantErr  bool
-	}{
-		{
-			name: "All match",
-			checkers: []MockChecker{
-				{Result: true, Err: nil},
-				{Result: true, Err: nil},
-			},
-			want:    true,
-			wantErr: false,
-		},
-		{
-			name: "One match",
-			checkers: []MockChecker{
-				{Result: false, Err: nil},
-				{Result: true, Err: nil},
-			},
-			want:    true,
-			wantErr: false,
-		},
-		{
-			name: "No match",
-			checkers: []MockChecker{
-				{Result: false, Err: nil},
-				{Result: false, Err: nil},
-			},
-			want:    false,
-			wantErr: false,
-		},
-		{
-			name: "Error encountered",
-			checkers: []MockChecker{
-				{Result: false, Err: nil},
-				{Result: false, Err: http.ErrNotSupported},
-			},
-			want:    false,
-			wantErr: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			var any Any
-			for _, mc := range tt.checkers {
-				any = append(any, mc)
-			}
-
-			got, err := any.Check(nil)
-			if (err != nil) != tt.wantErr {
-				t.Errorf("Any.Check() error = %v, wantErr %v", err, tt.wantErr)
-				return
-			}
-			if got != tt.want {
-				t.Errorf("Any.Check() = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}

lib/checker/checker.go

@@ -1,17 +0,0 @@
-// Package checker defines the Checker interface and a helper utility to avoid import cycles.
-package checker
-
-import (
-	"errors"
-	"net/http"
-)
-
-var (
-	ErrUnparseableConfig = errors.New("checker: config is unparseable")
-	ErrInvalidConfig     = errors.New("checker: config is invalid")
-)
-
-type Interface interface {
-	Check(*http.Request) (matches bool, err error)
-	Hash() string
-}

lib/checker/expression/factory.go

@@ -1,43 +0,0 @@
-package expression
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-
-	"github.com/TecharoHQ/anubis/lib/checker"
-)
-
-func init() {
-	checker.Register("expression", Factory{})
-}
-
-type Factory struct{}
-
-func (f Factory) Build(ctx context.Context, data json.RawMessage) (checker.Interface, error) {
-	var fc = &Config{}
-
-	if err := json.Unmarshal([]byte(data), fc); err != nil {
-		return nil, errors.Join(checker.ErrUnparseableConfig, err)
-	}
-
-	if err := fc.Valid(); err != nil {
-		return nil, errors.Join(checker.ErrInvalidConfig, err)
-	}
-
-	return New(fc)
-}
-
-func (f Factory) Valid(ctx context.Context, data json.RawMessage) error {
-	var fc = &Config{}
-
-	if err := json.Unmarshal([]byte(data), fc); err != nil {
-		return err
-	}
-
-	if err := fc.Valid(); err != nil {
-		return err
-	}
-
-	return nil
-}

lib/checker/headerexists/checker.go

@@ -1,32 +0,0 @@
-package headerexists
-
-import (
-	"net/http"
-	"strings"
-
-	"github.com/TecharoHQ/anubis/internal"
-	"github.com/TecharoHQ/anubis/lib/checker"
-)
-
-func New(key string) checker.Interface {
-	return headerExistsChecker{
-		header: strings.TrimSpace(http.CanonicalHeaderKey(key)),
-		hash:   internal.FastHash(key),
-	}
-}
-
-type headerExistsChecker struct {
-	header, hash string
-}
-
-func (hec headerExistsChecker) Check(r *http.Request) (bool, error) {
-	if r.Header.Get(hec.header) != "" {
-		return true, nil
-	}
-
-	return false, nil
-}
-
-func (hec headerExistsChecker) Hash() string {
-	return hec.hash
-}

lib/checker/headerexists/checker_test.go

@@ -1,57 +0,0 @@
-package headerexists
-
-import (
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"testing"
-)
-
-func TestChecker(t *testing.T) {
-	fac := Factory{}
-
-	for _, tt := range []struct {
-		name      string
-		header    string
-		reqHeader string
-		ok        bool
-	}{
-		{
-			name:      "match",
-			header:    "Authorization",
-			reqHeader: "Authorization",
-			ok:        true,
-		},
-		{
-			name:      "not_match",
-			header:    "Authorization",
-			reqHeader: "Authentication",
-		},
-	} {
-		t.Run(tt.name, func(t *testing.T) {
-			hec, err := fac.Build(t.Context(), json.RawMessage(fmt.Sprintf("%q", tt.header)))
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			t.Log(hec.Hash())
-
-			r, err := http.NewRequest(http.MethodGet, "/", nil)
-			if err != nil {
-				t.Fatalf("can't make request: %v", err)
-			}
-
-			r.Header.Set(tt.reqHeader, "hunter2")
-
-			ok, err := hec.Check(r)
-
-			if tt.ok != ok {
-				t.Errorf("ok: %v, wanted: %v", ok, tt.ok)
-			}
-
-			if err != nil {
-				t.Errorf("err: %v", err)
-			}
-		})
-	}
-}

lib/checker/headerexists/factory.go

@@ -1,40 +0,0 @@
-package headerexists
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/http"
-
-	"github.com/TecharoHQ/anubis/lib/checker"
-)
-
-type Factory struct{}
-
-func (f Factory) Build(ctx context.Context, data json.RawMessage) (checker.Interface, error) {
-	var headerName string
-
-	if err := json.Unmarshal([]byte(data), &headerName); err != nil {
-		return nil, fmt.Errorf("%w: want string", checker.ErrUnparseableConfig)
-	}
-
-	if err := f.Valid(ctx, data); err != nil {
-		return nil, err
-	}
-
-	return New(http.CanonicalHeaderKey(headerName)), nil
-}
-
-func (Factory) Valid(ctx context.Context, data json.RawMessage) error {
-	var headerName string
-
-	if err := json.Unmarshal([]byte(data), &headerName); err != nil {
-		return fmt.Errorf("%w: want string", checker.ErrUnparseableConfig)
-	}
-
-	if headerName == "" {
-		return fmt.Errorf("%w: string must not be empty", checker.ErrInvalidConfig)
-	}
-
-	return nil
-}

lib/checker/headerexists/factory_test.go

@@ -1,60 +0,0 @@
-package headerexists
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestFactoryGood(t *testing.T) {
-	files, err := os.ReadDir("./testdata/good")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	fac := Factory{}
-
-	for _, fname := range files {
-		t.Run(fname.Name(), func(t *testing.T) {
-			data, err := os.ReadFile(filepath.Join("testdata", "good", fname.Name()))
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			if err := fac.Valid(t.Context(), json.RawMessage(data)); err != nil {
-				t.Fatal(err)
-			}
-		})
-	}
-}
-
-func TestFactoryBad(t *testing.T) {
-	files, err := os.ReadDir("./testdata/bad")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	fac := Factory{}
-
-	for _, fname := range files {
-		t.Run(fname.Name(), func(t *testing.T) {
-			data, err := os.ReadFile(filepath.Join("testdata", "bad", fname.Name()))
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			t.Run("Build", func(t *testing.T) {
-				if _, err := fac.Build(t.Context(), json.RawMessage(data)); err == nil {
-					t.Fatal(err)
-				}
-			})
-
-			t.Run("Valid", func(t *testing.T) {
-				if err := fac.Valid(t.Context(), json.RawMessage(data)); err == nil {
-					t.Fatal(err)
-				}
-			})
-		})
-	}
-}

lib/checker/headerexists/testdata/bad/empty.json

@@ -1 +0,0 @@
-""

lib/checker/headerexists/testdata/bad/object.json

@@ -1 +0,0 @@
-{}

lib/checker/headerexists/testdata/good/authorization.json

@@ -1 +0,0 @@
-"Authorization"

lib/checker/headermatches/checker.go

@@ -1,46 +0,0 @@
-package headermatches
-
-import (
-	"context"
-	"encoding/json"
-	"net/http"
-	"regexp"
-
-	"github.com/TecharoHQ/anubis/lib/checker"
-)
-
-type Checker struct {
-	header string
-	regexp *regexp.Regexp
-	hash   string
-}
-
-func (c *Checker) Check(r *http.Request) (bool, error) {
-	if c.regexp.MatchString(r.Header.Get(c.header)) {
-		return true, nil
-	}
-
-	return false, nil
-}
-
-func (c *Checker) Hash() string {
-	return c.hash
-}
-
-func New(key, valueRex string) (checker.Interface, error) {
-	fc := fileConfig{
-		Header:     key,
-		ValueRegex: valueRex,
-	}
-
-	if err := fc.Valid(); err != nil {
-		return nil, err
-	}
-
-	data, err := json.Marshal(fc)
-	if err != nil {
-		return nil, err
-	}
-
-	return Factory{}.Build(context.Background(), json.RawMessage(data))
-}

lib/checker/headermatches/checker_test.go

@@ -1,98 +0,0 @@
-package headermatches
-
-import (
-	"encoding/json"
-	"errors"
-	"net/http"
-	"testing"
-)
-
-func TestChecker(t *testing.T) {
-
-}
-
-func TestHeaderMatchesChecker(t *testing.T) {
-	fac := Factory{}
-
-	for _, tt := range []struct {
-		err            error
-		name           string
-		header         string
-		rexStr         string
-		reqHeaderKey   string
-		reqHeaderValue string
-		ok             bool
-	}{
-		{
-			name:           "match",
-			header:         "Cf-Worker",
-			rexStr:         ".*",
-			reqHeaderKey:   "Cf-Worker",
-			reqHeaderValue: "true",
-			ok:             true,
-			err:            nil,
-		},
-		{
-			name:           "not_match",
-			header:         "Cf-Worker",
-			rexStr:         "false",
-			reqHeaderKey:   "Cf-Worker",
-			reqHeaderValue: "true",
-			ok:             false,
-			err:            nil,
-		},
-		{
-			name:           "not_present",
-			header:         "Cf-Worker",
-			rexStr:         "foobar",
-			reqHeaderKey:   "Something-Else",
-			reqHeaderValue: "true",
-			ok:             false,
-			err:            nil,
-		},
-		{
-			name:   "invalid_regex",
-			rexStr: "a(b",
-			err:    ErrInvalidRegex,
-		},
-	} {
-		t.Run(tt.name, func(t *testing.T) {
-			fc := fileConfig{
-				Header:     tt.header,
-				ValueRegex: tt.rexStr,
-			}
-			data, err := json.Marshal(fc)
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			hmc, err := fac.Build(t.Context(), json.RawMessage(data))
-			if err != nil && !errors.Is(err, tt.err) {
-				t.Fatalf("creating HeaderMatchesChecker failed")
-			}
-
-			if tt.err != nil && hmc == nil {
-				return
-			}
-
-			t.Log(hmc.Hash())
-
-			r, err := http.NewRequest(http.MethodGet, "/", nil)
-			if err != nil {
-				t.Fatalf("can't make request: %v", err)
-			}
-
-			r.Header.Set(tt.reqHeaderKey, tt.reqHeaderValue)
-
-			ok, err := hmc.Check(r)
-
-			if tt.ok != ok {
-				t.Errorf("ok: %v, wanted: %v", ok, tt.ok)
-			}
-
-			if err != nil && tt.err != nil && !errors.Is(err, tt.err) {
-				t.Errorf("err: %v, wanted: %v", err, tt.err)
-			}
-		})
-	}
-}

lib/checker/headermatches/config.go

@@ -1,44 +0,0 @@
-package headermatches
-
-import (
-	"errors"
-	"fmt"
-	"regexp"
-)
-
-var (
-	ErrNoHeader     = errors.New("headermatches: no header is configured")
-	ErrNoValueRegex = errors.New("headermatches: no value regex is configured")
-	ErrInvalidRegex = errors.New("headermatches: value regex is invalid")
-)
-
-type fileConfig struct {
-	Header     string `json:"header" yaml:"header"`
-	ValueRegex string `json:"value_regex" yaml:"value_regex"`
-}
-
-func (fc fileConfig) String() string {
-	return fmt.Sprintf("header=%q value_regex=%q", fc.Header, fc.ValueRegex)
-}
-
-func (fc fileConfig) Valid() error {
-	var errs []error
-
-	if fc.Header == "" {
-		errs = append(errs, ErrNoHeader)
-	}
-
-	if fc.ValueRegex == "" {
-		errs = append(errs, ErrNoValueRegex)
-	}
-
-	if _, err := regexp.Compile(fc.ValueRegex); err != nil {
-		errs = append(errs, ErrInvalidRegex, err)
-	}
-
-	if len(errs) != 0 {
-		return errors.Join(errs...)
-	}
-
-	return nil
-}

lib/checker/headermatches/config_test.go

@@ -1,55 +0,0 @@
-package headermatches
-
-import (
-	"errors"
-	"testing"
-)
-
-func TestFileConfigValid(t *testing.T) {
-	for _, tt := range []struct {
-		name, description string
-		in                fileConfig
-		err               error
-	}{
-		{
-			name:        "simple happy",
-			description: "the most common usecase",
-			in: fileConfig{
-				Header:     "User-Agent",
-				ValueRegex: ".*",
-			},
-		},
-		{
-			name:        "no header",
-			description: "Header must be set, it is not",
-			in: fileConfig{
-				ValueRegex: ".*",
-			},
-			err: ErrNoHeader,
-		},
-		{
-			name:        "no value regex",
-			description: "ValueRegex must be set, it is not",
-			in: fileConfig{
-				Header: "User-Agent",
-			},
-			err: ErrNoValueRegex,
-		},
-		{
-			name:        "invalid regex",
-			description: "the user wrote an invalid value regular expression",
-			in: fileConfig{
-				Header:     "User-Agent",
-				ValueRegex: "[a-z",
-			},
-			err: ErrInvalidRegex,
-		},
-	} {
-		t.Run(tt.name, func(t *testing.T) {
-			if err := tt.in.Valid(); !errors.Is(err, tt.err) {
-				t.Log(tt.description)
-				t.Fatal(err)
-			}
-		})
-	}
-}

lib/checker/headermatches/factory.go

@@ -1,66 +0,0 @@
-package headermatches
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"net/http"
-	"regexp"
-
-	"github.com/TecharoHQ/anubis/internal"
-	"github.com/TecharoHQ/anubis/lib/checker"
-)
-
-func init() {
-	checker.Register("header_matches", Factory{})
-	checker.Register("user_agent", Factory{defaultHeader: "User-Agent"})
-}
-
-type Factory struct {
-	defaultHeader string
-}
-
-func (f Factory) Build(ctx context.Context, data json.RawMessage) (checker.Interface, error) {
-	var fc fileConfig
-
-	if f.defaultHeader != "" {
-		fc.Header = f.defaultHeader
-	}
-
-	if err := json.Unmarshal([]byte(data), &fc); err != nil {
-		return nil, errors.Join(checker.ErrUnparseableConfig, err)
-	}
-
-	if err := fc.Valid(); err != nil {
-		return nil, errors.Join(checker.ErrInvalidConfig, err)
-	}
-
-	valueRex, err := regexp.Compile(fc.ValueRegex)
-	if err != nil {
-		return nil, errors.Join(ErrInvalidRegex, err)
-	}
-
-	return &Checker{
-		header: http.CanonicalHeaderKey(fc.Header),
-		regexp: valueRex,
-		hash:   internal.FastHash(fc.String()),
-	}, nil
-}
-
-func (f Factory) Valid(ctx context.Context, data json.RawMessage) error {
-	var fc fileConfig
-
-	if f.defaultHeader != "" {
-		fc.Header = f.defaultHeader
-	}
-
-	if err := json.Unmarshal([]byte(data), &fc); err != nil {
-		return err
-	}
-
-	if err := fc.Valid(); err != nil {
-		return err
-	}
-
-	return nil
-}

lib/checker/headermatches/factory_test.go

@@ -1,52 +0,0 @@
-package headermatches
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestFactoryGood(t *testing.T) {
-	files, err := os.ReadDir("./testdata/good")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	fac := Factory{}
-
-	for _, fname := range files {
-		t.Run(fname.Name(), func(t *testing.T) {
-			data, err := os.ReadFile(filepath.Join("testdata", "good", fname.Name()))
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			if err := fac.Valid(t.Context(), json.RawMessage(data)); err != nil {
-				t.Fatal(err)
-			}
-		})
-	}
-}
-
-func TestFactoryBad(t *testing.T) {
-	files, err := os.ReadDir("./testdata/bad")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	fac := Factory{}
-
-	for _, fname := range files {
-		t.Run(fname.Name(), func(t *testing.T) {
-			data, err := os.ReadFile(filepath.Join("testdata", "bad", fname.Name()))
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			if err := fac.Valid(t.Context(), json.RawMessage(data)); err == nil {
-				t.Fatal(err)
-			}
-		})
-	}
-}

lib/checker/headermatches/testdata/bad/invalid_config.json

@@ -1 +0,0 @@
-}

lib/checker/headermatches/testdata/bad/invalid_value_regex.json

@@ -1,4 +0,0 @@
-{
-  "header": "User-Agent",
-  "value_regex": "a(b"
-}

lib/checker/headermatches/testdata/bad/no_header.json

@@ -1,3 +0,0 @@
-{
-  "value_regex": "PaleMoon"
-}

lib/checker/headermatches/testdata/bad/no_value_regex.json

@@ -1,3 +0,0 @@
-{
-  "header": "User-Agent"
-}

lib/checker/headermatches/testdata/bad/nothing.json

@@ -1 +0,0 @@
-{}

lib/checker/headermatches/testdata/good/simple.json

@@ -1,4 +0,0 @@
-{
-  "header": "User-Agent",
-  "value_regex": "PaleMoon"
-}

lib/checker/headermatches/useragent.go

@@ -1,35 +0,0 @@
-package headermatches
-
-import (
-	"context"
-	"encoding/json"
-
-	"github.com/TecharoHQ/anubis/lib/checker"
-)
-
-func ValidUserAgent(valueRex string) error {
-	fc := fileConfig{
-		Header:     "User-Agent",
-		ValueRegex: valueRex,
-	}
-
-	return fc.Valid()
-}
-
-func NewUserAgent(valueRex string) (checker.Interface, error) {
-	fc := fileConfig{
-		Header:     "User-Agent",
-		ValueRegex: valueRex,
-	}
-
-	if err := fc.Valid(); err != nil {
-		return nil, err
-	}
-
-	data, err := json.Marshal(fc)
-	if err != nil {
-		return nil, err
-	}
-
-	return Factory{}.Build(context.Background(), json.RawMessage(data))
-}

lib/checker/path/checker.go

@@ -1,37 +0,0 @@
-package path
-
-import (
-	"fmt"
-	"net/http"
-	"regexp"
-	"strings"
-
-	"github.com/TecharoHQ/anubis"
-	"github.com/TecharoHQ/anubis/internal"
-	"github.com/TecharoHQ/anubis/lib/checker"
-)
-
-func New(rexStr string) (checker.Interface, error) {
-	rex, err := regexp.Compile(strings.TrimSpace(rexStr))
-	if err != nil {
-		return nil, fmt.Errorf("%w: regex %s failed parse: %w", anubis.ErrMisconfiguration, rexStr, err)
-	}
-	return &Checker{rex, internal.FastHash(rexStr)}, nil
-}
-
-type Checker struct {
-	regexp *regexp.Regexp
-	hash   string
-}
-
-func (c *Checker) Check(r *http.Request) (bool, error) {
-	if c.regexp.MatchString(r.URL.Path) {
-		return true, nil
-	}
-
-	return false, nil
-}
-
-func (c *Checker) Hash() string {
-	return c.hash
-}

lib/checker/path/checker_test.go

@@ -1,90 +0,0 @@
-package path
-
-import (
-	"encoding/json"
-	"errors"
-	"net/http"
-	"testing"
-)
-
-func TestChecker(t *testing.T) {
-	fac := Factory{}
-
-	for _, tt := range []struct {
-		err     error
-		name    string
-		rexStr  string
-		reqPath string
-		ok      bool
-	}{
-		{
-			name:    "match",
-			rexStr:  "^/api/.*",
-			reqPath: "/api/v1/users",
-			ok:      true,
-			err:     nil,
-		},
-		{
-			name:    "not_match",
-			rexStr:  "^/api/.*",
-			reqPath: "/static/index.html",
-			ok:      false,
-			err:     nil,
-		},
-		{
-			name:    "wildcard_match",
-			rexStr:  ".*\\.json$",
-			reqPath: "/data/config.json",
-			ok:      true,
-			err:     nil,
-		},
-		{
-			name:    "wildcard_not_match",
-			rexStr:  ".*\\.json$",
-			reqPath: "/data/config.yaml",
-			ok:      false,
-			err:     nil,
-		},
-		{
-			name:   "invalid_regex",
-			rexStr: "a(b",
-			err:    ErrInvalidRegex,
-		},
-	} {
-		t.Run(tt.name, func(t *testing.T) {
-			fc := fileConfig{
-				Regex: tt.rexStr,
-			}
-			data, err := json.Marshal(fc)
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			pc, err := fac.Build(t.Context(), json.RawMessage(data))
-			if err != nil && !errors.Is(err, tt.err) {
-				t.Fatalf("creating PathChecker failed")
-			}
-
-			if tt.err != nil && pc == nil {
-				return
-			}
-
-			t.Log(pc.Hash())
-
-			r, err := http.NewRequest(http.MethodGet, tt.reqPath, nil)
-			if err != nil {
-				t.Fatalf("can't make request: %v", err)
-			}
-
-			ok, err := pc.Check(r)
-
-			if tt.ok != ok {
-				t.Errorf("ok: %v, wanted: %v", ok, tt.ok)
-			}
-
-			if err != nil && tt.err != nil && !errors.Is(err, tt.err) {
-				t.Errorf("err: %v, wanted: %v", err, tt.err)
-			}
-		})
-	}
-}

lib/checker/path/config.go

@@ -1,38 +0,0 @@
-package path
-
-import (
-	"errors"
-	"fmt"
-	"regexp"
-)
-
-var (
-	ErrNoRegex      = errors.New("path: no regex is configured")
-	ErrInvalidRegex = errors.New("path: regex is invalid")
-)
-
-type fileConfig struct {
-	Regex string `json:"regex" yaml:"regex"`
-}
-
-func (fc fileConfig) String() string {
-	return fmt.Sprintf("regex=%q", fc.Regex)
-}
-
-func (fc fileConfig) Valid() error {
-	var errs []error
-
-	if fc.Regex == "" {
-		errs = append(errs, ErrNoRegex)
-	}
-
-	if _, err := regexp.Compile(fc.Regex); err != nil {
-		errs = append(errs, ErrInvalidRegex, err)
-	}
-
-	if len(errs) != 0 {
-		return errors.Join(errs...)
-	}
-
-	return nil
-}

lib/checker/path/config_test.go

@@ -1,50 +0,0 @@
-package path
-
-import (
-	"errors"
-	"testing"
-)
-
-func TestFileConfigValid(t *testing.T) {
-	for _, tt := range []struct {
-		name, description string
-		in                fileConfig
-		err               error
-	}{
-		{
-			name:        "simple happy",
-			description: "the most common usecase",
-			in: fileConfig{
-				Regex: "^/api/.*",
-			},
-		},
-		{
-			name:        "wildcard match",
-			description: "match files with specific extension",
-			in: fileConfig{
-				Regex: ".*[.]json$",
-			},
-		},
-		{
-			name:        "no regex",
-			description: "Regex must be set, it is not",
-			in:          fileConfig{},
-			err:         ErrNoRegex,
-		},
-		{
-			name:        "invalid regex",
-			description: "the user wrote an invalid regular expression",
-			in: fileConfig{
-				Regex: "[a-z",
-			},
-			err: ErrInvalidRegex,
-		},
-	} {
-		t.Run(tt.name, func(t *testing.T) {
-			if err := tt.in.Valid(); !errors.Is(err, tt.err) {
-				t.Log(tt.description)
-				t.Fatalf("got %v, wanted %v", err, tt.err)
-			}
-		})
-	}
-}

lib/checker/path/factory.go

@@ -1,58 +0,0 @@
-package path
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"regexp"
-	"strings"
-
-	"github.com/TecharoHQ/anubis/internal"
-	"github.com/TecharoHQ/anubis/lib/checker"
-)
-
-func init() {
-	checker.Register("path", Factory{})
-}
-
-type Factory struct{}
-
-func (f Factory) Build(ctx context.Context, data json.RawMessage) (checker.Interface, error) {
-	var fc fileConfig
-
-	if err := json.Unmarshal([]byte(data), &fc); err != nil {
-		return nil, errors.Join(checker.ErrUnparseableConfig, err)
-	}
-
-	if err := fc.Valid(); err != nil {
-		return nil, errors.Join(checker.ErrInvalidConfig, err)
-	}
-
-	pathRex, err := regexp.Compile(strings.TrimSpace(fc.Regex))
-	if err != nil {
-		return nil, errors.Join(ErrInvalidRegex, err)
-	}
-
-	return &Checker{
-		regexp: pathRex,
-		hash:   internal.FastHash(fc.String()),
-	}, nil
-}
-
-func (f Factory) Valid(ctx context.Context, data json.RawMessage) error {
-	var fc fileConfig
-
-	if err := json.Unmarshal([]byte(data), &fc); err != nil {
-		return errors.Join(checker.ErrUnparseableConfig, err)
-	}
-
-	return fc.Valid()
-}
-
-func Valid(pathRex string) error {
-	fc := fileConfig{
-		Regex: pathRex,
-	}
-
-	return fc.Valid()
-}

lib/checker/path/factory_test.go

@@ -1,52 +0,0 @@
-package path
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestFactoryGood(t *testing.T) {
-	files, err := os.ReadDir("./testdata/good")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	fac := Factory{}
-
-	for _, fname := range files {
-		t.Run(fname.Name(), func(t *testing.T) {
-			data, err := os.ReadFile(filepath.Join("testdata", "good", fname.Name()))
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			if err := fac.Valid(t.Context(), json.RawMessage(data)); err != nil {
-				t.Fatal(err)
-			}
-		})
-	}
-}
-
-func TestFactoryBad(t *testing.T) {
-	files, err := os.ReadDir("./testdata/bad")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	fac := Factory{}
-
-	for _, fname := range files {
-		t.Run(fname.Name(), func(t *testing.T) {
-			data, err := os.ReadFile(filepath.Join("testdata", "bad", fname.Name()))
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			if err := fac.Valid(t.Context(), json.RawMessage(data)); err == nil {
-				t.Fatal("expected validation to fail")
-			}
-		})
-	}
-}

lib/checker/path/testdata/bad/invalid_regex.json

@@ -1,3 +0,0 @@
-{
-  "regex": "a(b"
-}

lib/checker/path/testdata/bad/nothing.json

@@ -1 +0,0 @@
-{}

lib/checker/path/testdata/good/simple.json

@@ -1,3 +0,0 @@
-{
-  "regex": "^/api/.*"
-}

lib/checker/path/testdata/good/wildcard.json

@@ -1,3 +0,0 @@
-{
-  "regex": ".*\\.json$"
-}

lib/checker/registry.go

@@ -1,43 +0,0 @@
-package checker
-
-import (
-	"context"
-	"encoding/json"
-	"sort"
-	"sync"
-)
-
-type Factory interface {
-	Build(context.Context, json.RawMessage) (Interface, error)
-	Valid(context.Context, json.RawMessage) error
-}
-
-var (
-	registry map[string]Factory = map[string]Factory{}
-	regLock  sync.RWMutex
-)
-
-func Register(name string, factory Factory) {
-	regLock.Lock()
-	defer regLock.Unlock()
-
-	registry[name] = factory
-}
-
-func Get(name string) (Factory, bool) {
-	regLock.RLock()
-	defer regLock.RUnlock()
-	result, ok := registry[name]
-	return result, ok
-}
-
-func Methods() []string {
-	regLock.RLock()
-	defer regLock.RUnlock()
-	var result []string
-	for method := range registry {
-		result = append(result, method)
-	}
-	sort.Strings(result)
-	return result
-}

lib/checker/remoteaddress/remoteaddress.go

@@ -1,127 +0,0 @@
-package remoteaddress
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net/http"
-	"net/netip"
-
-	"github.com/TecharoHQ/anubis"
-	"github.com/TecharoHQ/anubis/internal"
-	"github.com/TecharoHQ/anubis/lib/checker"
-	"github.com/gaissmai/bart"
-)
-
-var (
-	ErrNoRemoteAddresses = errors.New("remoteaddress: no remote addresses defined")
-	ErrInvalidCIDR       = errors.New("remoteaddress: invalid CIDR")
-)
-
-func init() {
-	checker.Register("remote_address", Factory{})
-}
-
-type Factory struct{}
-
-func (Factory) Valid(_ context.Context, inp json.RawMessage) error {
-	var fc fileConfig
-	if err := json.Unmarshal([]byte(inp), &fc); err != nil {
-		return fmt.Errorf("%w: %w", checker.ErrUnparseableConfig, err)
-	}
-
-	if err := fc.Valid(); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (Factory) Build(_ context.Context, inp json.RawMessage) (checker.Interface, error) {
-	c := struct {
-		RemoteAddr []netip.Prefix `json:"remote_addresses,omitempty" yaml:"remote_addresses,omitempty"`
-	}{}
-
-	if err := json.Unmarshal([]byte(inp), &c); err != nil {
-		return nil, fmt.Errorf("%w: %w", checker.ErrUnparseableConfig, err)
-	}
-
-	table := new(bart.Lite)
-
-	for _, cidr := range c.RemoteAddr {
-		table.Insert(cidr)
-	}
-
-	return &RemoteAddrChecker{
-		prefixTable: table,
-		hash:        internal.FastHash(string(inp)),
-	}, nil
-}
-
-type fileConfig struct {
-	RemoteAddr []string `json:"remote_addresses,omitempty" yaml:"remote_addresses,omitempty"`
-}
-
-func (fc fileConfig) Valid() error {
-	var errs []error
-
-	if len(fc.RemoteAddr) == 0 {
-		errs = append(errs, ErrNoRemoteAddresses)
-	}
-
-	for _, cidr := range fc.RemoteAddr {
-		if _, err := netip.ParsePrefix(cidr); err != nil {
-			errs = append(errs, fmt.Errorf("%w: cidr %q is invalid: %w", ErrInvalidCIDR, cidr, err))
-		}
-	}
-
-	if len(errs) != 0 {
-		return fmt.Errorf("%w: %w", checker.ErrInvalidConfig, errors.Join(errs...))
-	}
-
-	return nil
-}
-
-func Valid(cidrs []string) error {
-	fc := fileConfig{
-		RemoteAddr: cidrs,
-	}
-
-	return fc.Valid()
-}
-
-func New(cidrs []string) (checker.Interface, error) {
-	fc := fileConfig{
-		RemoteAddr: cidrs,
-	}
-	data, err := json.Marshal(fc)
-	if err != nil {
-		return nil, err
-	}
-
-	return Factory{}.Build(context.Background(), json.RawMessage(data))
-}
-
-type RemoteAddrChecker struct {
-	prefixTable *bart.Lite
-	hash        string
-}
-
-func (rac *RemoteAddrChecker) Check(r *http.Request) (bool, error) {
-	host := r.Header.Get("X-Real-Ip")
-	if host == "" {
-		return false, fmt.Errorf("%w: header X-Real-Ip is not set", anubis.ErrMisconfiguration)
-	}
-
-	addr, err := netip.ParseAddr(host)
-	if err != nil {
-		return false, fmt.Errorf("%w: %s is not an IP address: %w", anubis.ErrMisconfiguration, host, err)
-	}
-
-	return rac.prefixTable.Contains(addr), nil
-}
-
-func (rac *RemoteAddrChecker) Hash() string {
-	return rac.hash
-}

lib/checker/remoteaddress/remoteaddress_test.go

@@ -1,138 +0,0 @@
-package remoteaddress_test
-
-import (
-	_ "embed"
-	"encoding/json"
-	"errors"
-	"net/http"
-	"testing"
-
-	"github.com/TecharoHQ/anubis/lib/checker"
-	"github.com/TecharoHQ/anubis/lib/checker/remoteaddress"
-)
-
-func TestFactoryIsCheckerFactory(t *testing.T) {
-	if _, ok := (any(remoteaddress.Factory{})).(checker.Factory); !ok {
-		t.Fatal("Factory is not an instance of checker.Factory")
-	}
-}
-
-func TestFactoryValidateConfig(t *testing.T) {
-	f := remoteaddress.Factory{}
-
-	for _, tt := range []struct {
-		name string
-		data []byte
-		err  error
-	}{
-		{
-			name: "basic valid",
-			data: []byte(`{
-  "remote_addresses": [
-    "1.1.1.1/32"
-  ]
-}`),
-		},
-		{
-			name: "not json",
-			data: []byte(`]`),
-			err:  checker.ErrUnparseableConfig,
-		},
-		{
-			name: "no cidr",
-			data: []byte(`{
-  "remote_addresses": []
-}`),
-			err: remoteaddress.ErrNoRemoteAddresses,
-		},
-		{
-			name: "bad cidr",
-			data: []byte(`{
-  "remote_addresses": [
-    "according to all laws of aviation"
-  ]
-}`),
-			err: remoteaddress.ErrInvalidCIDR,
-		},
-	} {
-		t.Run(tt.name, func(t *testing.T) {
-			data := json.RawMessage(tt.data)
-
-			if err := f.Valid(t.Context(), data); !errors.Is(err, tt.err) {
-				t.Logf("want: %v", tt.err)
-				t.Logf("got:  %v", err)
-				t.Fatal("validation didn't do what was expected")
-			}
-		})
-	}
-}
-
-func TestFactoryCreate(t *testing.T) {
-	f := remoteaddress.Factory{}
-
-	for _, tt := range []struct {
-		name  string
-		data  []byte
-		err   error
-		ip    string
-		match bool
-	}{
-		{
-			name: "basic valid",
-			data: []byte(`{
-  "remote_addresses": [
-    "1.1.1.1/32"
-  ]
-}`),
-			ip:    "1.1.1.1",
-			match: true,
-		},
-		{
-			name: "bad cidr",
-			data: []byte(`{
-  "remote_addresses": [
-    "according to all laws of aviation"
-  ]
-}`),
-			err: checker.ErrUnparseableConfig,
-		},
-	} {
-		t.Run(tt.name, func(t *testing.T) {
-			data := json.RawMessage(tt.data)
-
-			impl, err := f.Build(t.Context(), data)
-			if !errors.Is(err, tt.err) {
-				t.Logf("want: %v", tt.err)
-				t.Logf("got:  %v", err)
-				t.Fatal("creation didn't do what was expected")
-			}
-
-			if tt.err != nil {
-				return
-			}
-
-			r, err := http.NewRequest(http.MethodGet, "/", nil)
-			if err != nil {
-				t.Fatalf("can't make request: %v", err)
-			}
-
-			if tt.ip != "" {
-				r.Header.Add("X-Real-Ip", tt.ip)
-			}
-
-			match, err := impl.Check(r)
-
-			if tt.match != match {
-				t.Errorf("match: %v, wanted: %v", match, tt.match)
-			}
-
-			if err != nil && tt.err != nil && !errors.Is(err, tt.err) {
-				t.Errorf("err: %v, wanted: %v", err, tt.err)
-			}
-
-			if impl.Hash() == "" {
-				t.Error("hash method returns empty string")
-			}
-		})
-	}
-}

lib/checker/remoteaddress/testdata/invalid_bad_cidr.json

@@ -1,5 +0,0 @@
-{
-  "remote_addresses": [
-    "according to all laws of aviation"
-  ]
-}

lib/checker/remoteaddress/testdata/invalid_no_cidr.json

@@ -1,3 +0,0 @@
-{
-  "remote_addresses": []
-}

lib/checker/remoteaddress/testdata/invalid_not_json.json

@@ -1 +0,0 @@
-]

lib/checker/remoteaddress/testdata/valid_addresses.json

@@ -1,5 +0,0 @@
-{
-  "remote_addresses": [
-    "1.1.1.1/32"
-  ]
-}

lib/config_test.go

@@ -7,8 +7,8 @@ import (
 	"testing"
 
 	"github.com/TecharoHQ/anubis"
+	"github.com/TecharoHQ/anubis/internal/thoth/thothmock"
 	"github.com/TecharoHQ/anubis/lib/policy"
-	"github.com/TecharoHQ/anubis/lib/thoth/thothmock"
 )
 
 func TestInvalidChallengeMethod(t *testing.T) {

lib/http.go

@@ -198,7 +198,7 @@ func (s *Server) respondWithError(w http.ResponseWriter, r *http.Request, messag
 func (s *Server) respondWithStatus(w http.ResponseWriter, r *http.Request, msg string, status int) {
 	localizer := localization.GetLocalizer(r)
 
-	templ.Handler(web.Base(localizer.T("oh_noes"), web.ErrorPage(msg, s.opts.WebmasterEmail, localizer), s.policy.Impressum, localizer), templ.WithStatus(status)).ServeHTTP(w, r)
+	templ.Handler(web.Base(localizer.T("oh_noes"), web.ErrorPage(msg, s.opts.WebmasterEmail, r.FormValue("redir"), localizer), s.policy.Impressum, localizer), templ.WithStatus(status)).ServeHTTP(w, r)
 }
 
 func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {

lib/policy/bot.go

@@ -4,12 +4,12 @@ import (
 	"fmt"
 
 	"github.com/TecharoHQ/anubis/internal"
-	"github.com/TecharoHQ/anubis/lib/checker"
+	"github.com/TecharoHQ/anubis/lib/policy/checker"
 	"github.com/TecharoHQ/anubis/lib/policy/config"
 )
 
 type Bot struct {
-	Rules     checker.Interface
+	Rules     checker.Impl
 	Challenge *config.ChallengeRules
 	Weight    *config.Weight
 	Name      string

lib/policy/celchecker.go

@@ -1,44 +1,43 @@
-package expression
+package policy
 
 import (
 	"fmt"
 	"net/http"
 
 	"github.com/TecharoHQ/anubis/internal"
-	"github.com/TecharoHQ/anubis/lib/checker/expression/environment"
+	"github.com/TecharoHQ/anubis/lib/policy/config"
+	"github.com/TecharoHQ/anubis/lib/policy/expressions"
 	"github.com/google/cel-go/cel"
 	"github.com/google/cel-go/common/types"
 )
 
-type Checker struct {
+type CELChecker struct {
 	program cel.Program
 	src     string
-	hash    string
 }
 
-func New(cfg *Config) (*Checker, error) {
-	env, err := environment.Bot()
+func NewCELChecker(cfg *config.ExpressionOrList) (*CELChecker, error) {
+	env, err := expressions.BotEnvironment()
 	if err != nil {
 		return nil, err
 	}
 
-	program, err := environment.Compile(env, cfg.String())
+	program, err := expressions.Compile(env, cfg.String())
 	if err != nil {
 		return nil, fmt.Errorf("can't compile CEL program: %w", err)
 	}
 
-	return &Checker{
+	return &CELChecker{
 		src:     cfg.String(),
-		hash:    internal.FastHash(cfg.String()),
 		program: program,
 	}, nil
 }
 
-func (cc *Checker) Hash() string {
-	return cc.hash
+func (cc *CELChecker) Hash() string {
+	return internal.FastHash(cc.src)
 }
 
-func (cc *Checker) Check(r *http.Request) (bool, error) {
+func (cc *CELChecker) Check(r *http.Request) (bool, error) {
 	result, _, err := cc.program.ContextEval(r.Context(), &CELRequest{r})
 
 	if err != nil {
@@ -71,15 +70,15 @@ func (cr *CELRequest) ResolveName(name string) (any, bool) {
 	case "path":
 		return cr.URL.Path, true
 	case "query":
-		return URLValues{Values: cr.URL.Query()}, true
+		return expressions.URLValues{Values: cr.URL.Query()}, true
 	case "headers":
-		return HTTPHeaders{Header: cr.Header}, true
+		return expressions.HTTPHeaders{Header: cr.Header}, true
 	case "load_1m":
-		return Load1(), true
+		return expressions.Load1(), true
 	case "load_5m":
-		return Load5(), true
+		return expressions.Load5(), true
 	case "load_15m":
-		return Load15(), true
+		return expressions.Load15(), true
 	default:
 		return nil, false
 	}

lib/policy/checker.go

@@ -3,39 +3,153 @@ package policy
 import (
 	"errors"
 	"fmt"
-	"sort"
+	"net/http"
+	"net/netip"
+	"regexp"
 	"strings"
 
-	"github.com/TecharoHQ/anubis/lib/checker"
-	"github.com/TecharoHQ/anubis/lib/checker/headerexists"
-	"github.com/TecharoHQ/anubis/lib/checker/headermatches"
+	"github.com/TecharoHQ/anubis/internal"
+	"github.com/TecharoHQ/anubis/lib/policy/checker"
+	"github.com/gaissmai/bart"
 )
 
-func NewHeadersChecker(headermap map[string]string) (checker.Interface, error) {
-	var result checker.All
-	var errs []error
+var (
+	ErrMisconfiguration = errors.New("[unexpected] policy: administrator misconfiguration")
+)
 
-	var keys []string
-	for key := range headermap {
-		keys = append(keys, key)
+type RemoteAddrChecker struct {
+	prefixTable *bart.Lite
+	hash        string
+}
+
+func NewRemoteAddrChecker(cidrs []string) (checker.Impl, error) {
+	table := new(bart.Lite)
+
+	for _, cidr := range cidrs {
+		prefix, err := netip.ParsePrefix(cidr)
+		if err != nil {
+			return nil, fmt.Errorf("%w: range %s not parsing: %w", ErrMisconfiguration, cidr, err)
+		}
+
+		table.Insert(prefix)
 	}
 
-	sort.Strings(keys)
+	return &RemoteAddrChecker{
+		prefixTable: table,
+		hash:        internal.FastHash(strings.Join(cidrs, ",")),
+	}, nil
+}
 
-	for _, key := range keys {
-		rexStr := headermap[key]
+func (rac *RemoteAddrChecker) Check(r *http.Request) (bool, error) {
+	host := r.Header.Get("X-Real-Ip")
+	if host == "" {
+		return false, fmt.Errorf("%w: header X-Real-Ip is not set", ErrMisconfiguration)
+	}
+
+	addr, err := netip.ParseAddr(host)
+	if err != nil {
+		return false, fmt.Errorf("%w: %s is not an IP address: %w", ErrMisconfiguration, host, err)
+	}
+
+	return rac.prefixTable.Contains(addr), nil
+}
+
+func (rac *RemoteAddrChecker) Hash() string {
+	return rac.hash
+}
+
+type HeaderMatchesChecker struct {
+	header string
+	regexp *regexp.Regexp
+	hash   string
+}
+
+func NewUserAgentChecker(rexStr string) (checker.Impl, error) {
+	return NewHeaderMatchesChecker("User-Agent", rexStr)
+}
+
+func NewHeaderMatchesChecker(header, rexStr string) (checker.Impl, error) {
+	rex, err := regexp.Compile(strings.TrimSpace(rexStr))
+	if err != nil {
+		return nil, fmt.Errorf("%w: regex %s failed parse: %w", ErrMisconfiguration, rexStr, err)
+	}
+	return &HeaderMatchesChecker{strings.TrimSpace(header), rex, internal.FastHash(header + ": " + rexStr)}, nil
+}
+
+func (hmc *HeaderMatchesChecker) Check(r *http.Request) (bool, error) {
+	if hmc.regexp.MatchString(r.Header.Get(hmc.header)) {
+		return true, nil
+	}
+
+	return false, nil
+}
+
+func (hmc *HeaderMatchesChecker) Hash() string {
+	return hmc.hash
+}
+
+type PathChecker struct {
+	regexp *regexp.Regexp
+	hash   string
+}
+
+func NewPathChecker(rexStr string) (checker.Impl, error) {
+	rex, err := regexp.Compile(strings.TrimSpace(rexStr))
+	if err != nil {
+		return nil, fmt.Errorf("%w: regex %s failed parse: %w", ErrMisconfiguration, rexStr, err)
+	}
+	return &PathChecker{rex, internal.FastHash(rexStr)}, nil
+}
+
+func (pc *PathChecker) Check(r *http.Request) (bool, error) {
+	if pc.regexp.MatchString(r.URL.Path) {
+		return true, nil
+	}
+
+	return false, nil
+}
+
+func (pc *PathChecker) Hash() string {
+	return pc.hash
+}
+
+func NewHeaderExistsChecker(key string) checker.Impl {
+	return headerExistsChecker{strings.TrimSpace(key)}
+}
+
+type headerExistsChecker struct {
+	header string
+}
+
+func (hec headerExistsChecker) Check(r *http.Request) (bool, error) {
+	if r.Header.Get(hec.header) != "" {
+		return true, nil
+	}
+
+	return false, nil
+}
+
+func (hec headerExistsChecker) Hash() string {
+	return internal.FastHash(hec.header)
+}
+
+func NewHeadersChecker(headermap map[string]string) (checker.Impl, error) {
+	var result checker.List
+	var errs []error
+
+	for key, rexStr := range headermap {
 		if rexStr == ".*" {
-			result = append(result, headerexists.New(strings.TrimSpace(key)))
+			result = append(result, headerExistsChecker{strings.TrimSpace(key)})
 			continue
 		}
 
-		c, err := headermatches.New(key, rexStr)
+		rex, err := regexp.Compile(strings.TrimSpace(rexStr))
 		if err != nil {
-			errs = append(errs, fmt.Errorf("while parsing header %s regex %s: %w", key, rexStr, err))
+			errs = append(errs, fmt.Errorf("while compiling header %s regex %s: %w", key, rexStr, err))
 			continue
 		}
 
-		result = append(result, c)
+		result = append(result, &HeaderMatchesChecker{key, rex, internal.FastHash(key + ": " + rexStr)})
 	}
 
 	if len(errs) != 0 {

lib/policy/checker/checker.go

@@ -0,0 +1,41 @@
+// Package checker defines the Checker interface and a helper utility to avoid import cycles.
+package checker
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/TecharoHQ/anubis/internal"
+)
+
+type Impl interface {
+	Check(*http.Request) (bool, error)
+	Hash() string
+}
+
+type List []Impl
+
+func (l List) Check(r *http.Request) (bool, error) {
+	for _, c := range l {
+		ok, err := c.Check(r)
+		if err != nil {
+			return ok, err
+		}
+		if ok {
+			return ok, nil
+		}
+	}
+
+	return false, nil
+}
+
+func (l List) Hash() string {
+	var sb strings.Builder
+
+	for _, c := range l {
+		fmt.Fprintln(&sb, c.Hash())
+	}
+
+	return internal.FastHash(sb.String())
+}

lib/policy/checker_test.go

@@ -0,0 +1,200 @@
+package policy
+
+import (
+	"errors"
+	"net/http"
+	"testing"
+)
+
+func TestRemoteAddrChecker(t *testing.T) {
+	for _, tt := range []struct {
+		err   error
+		name  string
+		ip    string
+		cidrs []string
+		ok    bool
+	}{
+		{
+			name:  "match_ipv4",
+			cidrs: []string{"0.0.0.0/0"},
+			ip:    "1.1.1.1",
+			ok:    true,
+			err:   nil,
+		},
+		{
+			name:  "match_ipv6",
+			cidrs: []string{"::/0"},
+			ip:    "cafe:babe::",
+			ok:    true,
+			err:   nil,
+		},
+		{
+			name:  "not_match_ipv4",
+			cidrs: []string{"1.1.1.1/32"},
+			ip:    "1.1.1.2",
+			ok:    false,
+			err:   nil,
+		},
+		{
+			name:  "not_match_ipv6",
+			cidrs: []string{"cafe:babe::/128"},
+			ip:    "cafe:babe:4::/128",
+			ok:    false,
+			err:   nil,
+		},
+		{
+			name:  "no_ip_set",
+			cidrs: []string{"::/0"},
+			ok:    false,
+			err:   ErrMisconfiguration,
+		},
+		{
+			name:  "invalid_ip",
+			cidrs: []string{"::/0"},
+			ip:    "According to all natural laws of aviation",
+			ok:    false,
+			err:   ErrMisconfiguration,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			rac, err := NewRemoteAddrChecker(tt.cidrs)
+			if err != nil && !errors.Is(err, tt.err) {
+				t.Fatalf("creating RemoteAddrChecker failed: %v", err)
+			}
+
+			r, err := http.NewRequest(http.MethodGet, "/", nil)
+			if err != nil {
+				t.Fatalf("can't make request: %v", err)
+			}
+
+			if tt.ip != "" {
+				r.Header.Add("X-Real-Ip", tt.ip)
+			}
+
+			ok, err := rac.Check(r)
+
+			if tt.ok != ok {
+				t.Errorf("ok: %v, wanted: %v", ok, tt.ok)
+			}
+
+			if err != nil && tt.err != nil && !errors.Is(err, tt.err) {
+				t.Errorf("err: %v, wanted: %v", err, tt.err)
+			}
+		})
+	}
+}
+
+func TestHeaderMatchesChecker(t *testing.T) {
+	for _, tt := range []struct {
+		err            error
+		name           string
+		header         string
+		rexStr         string
+		reqHeaderKey   string
+		reqHeaderValue string
+		ok             bool
+	}{
+		{
+			name:           "match",
+			header:         "Cf-Worker",
+			rexStr:         ".*",
+			reqHeaderKey:   "Cf-Worker",
+			reqHeaderValue: "true",
+			ok:             true,
+			err:            nil,
+		},
+		{
+			name:           "not_match",
+			header:         "Cf-Worker",
+			rexStr:         "false",
+			reqHeaderKey:   "Cf-Worker",
+			reqHeaderValue: "true",
+			ok:             false,
+			err:            nil,
+		},
+		{
+			name:           "not_present",
+			header:         "Cf-Worker",
+			rexStr:         "foobar",
+			reqHeaderKey:   "Something-Else",
+			reqHeaderValue: "true",
+			ok:             false,
+			err:            nil,
+		},
+		{
+			name:   "invalid_regex",
+			rexStr: "a(b",
+			err:    ErrMisconfiguration,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			hmc, err := NewHeaderMatchesChecker(tt.header, tt.rexStr)
+			if err != nil && !errors.Is(err, tt.err) {
+				t.Fatalf("creating HeaderMatchesChecker failed")
+			}
+
+			if tt.err != nil && hmc == nil {
+				return
+			}
+
+			r, err := http.NewRequest(http.MethodGet, "/", nil)
+			if err != nil {
+				t.Fatalf("can't make request: %v", err)
+			}
+
+			r.Header.Set(tt.reqHeaderKey, tt.reqHeaderValue)
+
+			ok, err := hmc.Check(r)
+
+			if tt.ok != ok {
+				t.Errorf("ok: %v, wanted: %v", ok, tt.ok)
+			}
+
+			if err != nil && tt.err != nil && !errors.Is(err, tt.err) {
+				t.Errorf("err: %v, wanted: %v", err, tt.err)
+			}
+		})
+	}
+}
+
+func TestHeaderExistsChecker(t *testing.T) {
+	for _, tt := range []struct {
+		name      string
+		header    string
+		reqHeader string
+		ok        bool
+	}{
+		{
+			name:      "match",
+			header:    "Authorization",
+			reqHeader: "Authorization",
+			ok:        true,
+		},
+		{
+			name:      "not_match",
+			header:    "Authorization",
+			reqHeader: "Authentication",
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			hec := headerExistsChecker{tt.header}
+
+			r, err := http.NewRequest(http.MethodGet, "/", nil)
+			if err != nil {
+				t.Fatalf("can't make request: %v", err)
+			}
+
+			r.Header.Set(tt.reqHeader, "hunter2")
+
+			ok, err := hec.Check(r)
+
+			if tt.ok != ok {
+				t.Errorf("ok: %v, wanted: %v", ok, tt.ok)
+			}
+
+			if err != nil {
+				t.Errorf("err: %v", err)
+			}
+		})
+	}
+}

lib/policy/config/config.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
+	"net"
 	"net/http"
 	"os"
 	"regexp"
@@ -12,10 +13,6 @@ import (
 	"time"
 
 	"github.com/TecharoHQ/anubis/data"
-	"github.com/TecharoHQ/anubis/lib/checker/expression"
-	"github.com/TecharoHQ/anubis/lib/checker/headermatches"
-	"github.com/TecharoHQ/anubis/lib/checker/path"
-	"github.com/TecharoHQ/anubis/lib/checker/remoteaddress"
 	"k8s.io/apimachinery/pkg/util/yaml"
 )
 
@@ -28,12 +25,12 @@ var (
 	ErrInvalidUserAgentRegex             = errors.New("config.Bot: invalid user agent regex")
 	ErrInvalidPathRegex                  = errors.New("config.Bot: invalid path regex")
 	ErrInvalidHeadersRegex               = errors.New("config.Bot: invalid headers regex")
+	ErrInvalidCIDR                       = errors.New("config.Bot: invalid CIDR")
 	ErrRegexEndsWithNewline              = errors.New("config.Bot: regular expression ends with newline (try >- instead of > in yaml)")
 	ErrInvalidImportStatement            = errors.New("config.ImportStatement: invalid source file")
 	ErrCantSetBotAndImportValuesAtOnce   = errors.New("config.BotOrImport: can't set bot rules and import values at the same time")
 	ErrMustSetBotOrImportRules           = errors.New("config.BotOrImport: rule definition is invalid, you must set either bot rules or an import statement, not both")
 	ErrStatusCodeNotValid                = errors.New("config.StatusCode: status code not valid, must be between 100 and 599")
-	ErrUnparseableConfig                 = errors.New("config: can't parse configuration file")
 )
 
 type Rule string
@@ -59,15 +56,15 @@ func (r Rule) Valid() error {
 const DefaultAlgorithm = "fast"
 
 type BotConfig struct {
-	UserAgentRegex *string            `json:"user_agent_regex,omitempty" yaml:"user_agent_regex,omitempty"`
-	PathRegex      *string            `json:"path_regex,omitempty" yaml:"path_regex,omitempty"`
-	HeadersRegex   map[string]string  `json:"headers_regex,omitempty" yaml:"headers_regex,omitempty"`
-	Expression     *expression.Config `json:"expression,omitempty" yaml:"expression,omitempty"`
-	Challenge      *ChallengeRules    `json:"challenge,omitempty" yaml:"challenge,omitempty"`
-	Weight         *Weight            `json:"weight,omitempty" yaml:"weight,omitempty"`
-	Name           string             `json:"name" yaml:"name"`
-	Action         Rule               `json:"action" yaml:"action"`
-	RemoteAddr     []string           `json:"remote_addresses,omitempty" yaml:"remote_addresses,omitempty"`
+	UserAgentRegex *string           `json:"user_agent_regex,omitempty" yaml:"user_agent_regex,omitempty"`
+	PathRegex      *string           `json:"path_regex,omitempty" yaml:"path_regex,omitempty"`
+	HeadersRegex   map[string]string `json:"headers_regex,omitempty" yaml:"headers_regex,omitempty"`
+	Expression     *ExpressionOrList `json:"expression,omitempty" yaml:"expression,omitempty"`
+	Challenge      *ChallengeRules   `json:"challenge,omitempty" yaml:"challenge,omitempty"`
+	Weight         *Weight           `json:"weight,omitempty" yaml:"weight,omitempty"`
+	Name           string            `json:"name" yaml:"name"`
+	Action         Rule              `json:"action" yaml:"action"`
+	RemoteAddr     []string          `json:"remote_addresses,omitempty" yaml:"remote_addresses,omitempty"`
 
 	// Thoth features
 	GeoIP *GeoIP `json:"geoip,omitempty"`
@@ -121,7 +118,7 @@ func (b *BotConfig) Valid() error {
 			errs = append(errs, fmt.Errorf("%w: user agent regex: %q", ErrRegexEndsWithNewline, *b.UserAgentRegex))
 		}
 
-		if err := headermatches.ValidUserAgent(*b.UserAgentRegex); err != nil {
+		if _, err := regexp.Compile(*b.UserAgentRegex); err != nil {
 			errs = append(errs, ErrInvalidUserAgentRegex, err)
 		}
 	}
@@ -131,7 +128,7 @@ func (b *BotConfig) Valid() error {
 			errs = append(errs, fmt.Errorf("%w: path regex: %q", ErrRegexEndsWithNewline, *b.PathRegex))
 		}
 
-		if err := path.Valid(*b.PathRegex); err != nil {
+		if _, err := regexp.Compile(*b.PathRegex); err != nil {
 			errs = append(errs, ErrInvalidPathRegex, err)
 		}
 	}
@@ -153,8 +150,10 @@ func (b *BotConfig) Valid() error {
 	}
 
 	if len(b.RemoteAddr) > 0 {
-		if err := remoteaddress.Valid(b.RemoteAddr); err != nil {
-			errs = append(errs, err)
+		for _, cidr := range b.RemoteAddr {
+			if _, _, err := net.ParseCIDR(cidr); err != nil {
+				errs = append(errs, ErrInvalidCIDR, err)
+			}
 		}
 	}
 

lib/policy/config/config_test.go

@@ -8,7 +8,6 @@ import (
 	"testing"
 
 	"github.com/TecharoHQ/anubis/data"
-	"github.com/TecharoHQ/anubis/lib/checker/remoteaddress"
 	. "github.com/TecharoHQ/anubis/lib/policy/config"
 )
 
@@ -138,7 +137,7 @@ func TestBotValid(t *testing.T) {
 				Action:     RuleAllow,
 				RemoteAddr: []string{"0.0.0.0/33"},
 			},
-			err: remoteaddress.ErrInvalidCIDR,
+			err: ErrInvalidCIDR,
 		},
 		{
 			name: "only filter by IP range",

lib/policy/config/expressionorlist.go

@@ -1,4 +1,4 @@
-package expression
+package config
 
 import (
 	"encoding/json"
@@ -9,18 +9,18 @@ import (
 )
 
 var (
-	ErrExpressionOrListMustBeStringOrObject = errors.New("expression: this must be a string or an object")
-	ErrExpressionEmpty                      = errors.New("expression: this expression is empty")
-	ErrExpressionCantHaveBoth               = errors.New("expression: expression block can't contain multiple expression types")
+	ErrExpressionOrListMustBeStringOrObject = errors.New("config: this must be a string or an object")
+	ErrExpressionEmpty                      = errors.New("config: this expression is empty")
+	ErrExpressionCantHaveBoth               = errors.New("config: expression block can't contain multiple expression types")
 )
 
-type Config struct {
+type ExpressionOrList struct {
 	Expression string   `json:"-" yaml:"-"`
 	All        []string `json:"all,omitempty" yaml:"all,omitempty"`
 	Any        []string `json:"any,omitempty" yaml:"any,omitempty"`
 }
 
-func (eol Config) String() string {
+func (eol ExpressionOrList) String() string {
 	switch {
 	case len(eol.Expression) != 0:
 		return eol.Expression
@@ -46,7 +46,7 @@ func (eol Config) String() string {
 	panic("this should not happen")
 }
 
-func (eol Config) Equal(rhs *Config) bool {
+func (eol ExpressionOrList) Equal(rhs *ExpressionOrList) bool {
 	if eol.Expression != rhs.Expression {
 		return false
 	}
@@ -62,7 +62,7 @@ func (eol Config) Equal(rhs *Config) bool {
 	return true
 }
 
-func (eol *Config) MarshalYAML() (any, error) {
+func (eol *ExpressionOrList) MarshalYAML() (any, error) {
 	switch {
 	case len(eol.All) == 1 && len(eol.Any) == 0:
 		eol.Expression = eol.All[0]
@@ -76,11 +76,11 @@ func (eol *Config) MarshalYAML() (any, error) {
 		return eol.Expression, nil
 	}
 
-	type RawExpressionOrList Config
+	type RawExpressionOrList ExpressionOrList
 	return RawExpressionOrList(*eol), nil
 }
 
-func (eol *Config) MarshalJSON() ([]byte, error) {
+func (eol *ExpressionOrList) MarshalJSON() ([]byte, error) {
 	switch {
 	case len(eol.All) == 1 && len(eol.Any) == 0:
 		eol.Expression = eol.All[0]
@@ -94,17 +94,17 @@ func (eol *Config) MarshalJSON() ([]byte, error) {
 		return json.Marshal(string(eol.Expression))
 	}
 
-	type RawExpressionOrList Config
+	type RawExpressionOrList ExpressionOrList
 	val := RawExpressionOrList(*eol)
 	return json.Marshal(val)
 }
 
-func (eol *Config) UnmarshalJSON(data []byte) error {
+func (eol *ExpressionOrList) UnmarshalJSON(data []byte) error {
 	switch string(data[0]) {
 	case `"`: // string
 		return json.Unmarshal(data, &eol.Expression)
 	case "{": // object
-		type RawExpressionOrList Config
+		type RawExpressionOrList ExpressionOrList
 		var val RawExpressionOrList
 		if err := json.Unmarshal(data, &val); err != nil {
 			return err
@@ -118,7 +118,7 @@ func (eol *Config) UnmarshalJSON(data []byte) error {
 	return ErrExpressionOrListMustBeStringOrObject
 }
 
-func (eol *Config) Valid() error {
+func (eol *ExpressionOrList) Valid() error {
 	if eol.Expression == "" && len(eol.All) == 0 && len(eol.Any) == 0 {
 		return ErrExpressionEmpty
 	}

lib/policy/config/expressionorlist_test.go

@@ -1,4 +1,4 @@
-package expression
+package config
 
 import (
 	"bytes"
@@ -12,13 +12,13 @@ import (
 func TestExpressionOrListMarshalJSON(t *testing.T) {
 	for _, tt := range []struct {
 		name   string
-		input  *Config
+		input  *ExpressionOrList
 		output []byte
 		err    error
 	}{
 		{
 			name: "single expression",
-			input: &Config{
+			input: &ExpressionOrList{
 				Expression: "true",
 			},
 			output: []byte(`"true"`),
@@ -26,7 +26,7 @@ func TestExpressionOrListMarshalJSON(t *testing.T) {
 		},
 		{
 			name: "all",
-			input: &Config{
+			input: &ExpressionOrList{
 				All: []string{"true", "true"},
 			},
 			output: []byte(`{"all":["true","true"]}`),
@@ -34,7 +34,7 @@ func TestExpressionOrListMarshalJSON(t *testing.T) {
 		},
 		{
 			name: "all one",
-			input: &Config{
+			input: &ExpressionOrList{
 				All: []string{"true"},
 			},
 			output: []byte(`"true"`),
@@ -42,7 +42,7 @@ func TestExpressionOrListMarshalJSON(t *testing.T) {
 		},
 		{
 			name: "any",
-			input: &Config{
+			input: &ExpressionOrList{
 				Any: []string{"true", "false"},
 			},
 			output: []byte(`{"any":["true","false"]}`),
@@ -50,7 +50,7 @@ func TestExpressionOrListMarshalJSON(t *testing.T) {
 		},
 		{
 			name: "any one",
-			input: &Config{
+			input: &ExpressionOrList{
 				Any: []string{"true"},
 			},
 			output: []byte(`"true"`),
@@ -75,13 +75,13 @@ func TestExpressionOrListMarshalJSON(t *testing.T) {
 func TestExpressionOrListMarshalYAML(t *testing.T) {
 	for _, tt := range []struct {
 		name   string
-		input  *Config
+		input  *ExpressionOrList
 		output []byte
 		err    error
 	}{
 		{
 			name: "single expression",
-			input: &Config{
+			input: &ExpressionOrList{
 				Expression: "true",
 			},
 			output: []byte(`"true"`),
@@ -89,7 +89,7 @@ func TestExpressionOrListMarshalYAML(t *testing.T) {
 		},
 		{
 			name: "all",
-			input: &Config{
+			input: &ExpressionOrList{
 				All: []string{"true", "true"},
 			},
 			output: []byte(`all:
@@ -99,7 +99,7 @@ func TestExpressionOrListMarshalYAML(t *testing.T) {
 		},
 		{
 			name: "all one",
-			input: &Config{
+			input: &ExpressionOrList{
 				All: []string{"true"},
 			},
 			output: []byte(`"true"`),
@@ -107,7 +107,7 @@ func TestExpressionOrListMarshalYAML(t *testing.T) {
 		},
 		{
 			name: "any",
-			input: &Config{
+			input: &ExpressionOrList{
 				Any: []string{"true", "false"},
 			},
 			output: []byte(`any:
@@ -117,7 +117,7 @@ func TestExpressionOrListMarshalYAML(t *testing.T) {
 		},
 		{
 			name: "any one",
-			input: &Config{
+			input: &ExpressionOrList{
 				Any: []string{"true"},
 			},
 			output: []byte(`"true"`),
@@ -145,14 +145,14 @@ func TestExpressionOrListUnmarshalJSON(t *testing.T) {
 	for _, tt := range []struct {
 		err      error
 		validErr error
-		result   *Config
+		result   *ExpressionOrList
 		name     string
 		inp      string
 	}{
 		{
 			name: "simple",
 			inp:  `"\"User-Agent\" in headers"`,
-			result: &Config{
+			result: &ExpressionOrList{
 				Expression: `"User-Agent" in headers`,
 			},
 		},
@@ -161,7 +161,7 @@ func TestExpressionOrListUnmarshalJSON(t *testing.T) {
 			inp: `{
 			"all": ["\"User-Agent\" in headers"]
 			}`,
-			result: &Config{
+			result: &ExpressionOrList{
 				All: []string{
 					`"User-Agent" in headers`,
 				},
@@ -172,7 +172,7 @@ func TestExpressionOrListUnmarshalJSON(t *testing.T) {
 			inp: `{
 			"any": ["\"User-Agent\" in headers"]
 			}`,
-			result: &Config{
+			result: &ExpressionOrList{
 				Any: []string{
 					`"User-Agent" in headers`,
 				},
@@ -195,7 +195,7 @@ func TestExpressionOrListUnmarshalJSON(t *testing.T) {
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
-			var eol Config
+			var eol ExpressionOrList
 
 			if err := json.Unmarshal([]byte(tt.inp), &eol); !errors.Is(err, tt.err) {
 				t.Errorf("wanted unmarshal error: %v but got: %v", tt.err, err)
@@ -217,40 +217,40 @@ func TestExpressionOrListUnmarshalJSON(t *testing.T) {
 func TestExpressionOrListString(t *testing.T) {
 	for _, tt := range []struct {
 		name string
-		in   Config
+		in   ExpressionOrList
 		out  string
 	}{
 		{
 			name: "single expression",
-			in: Config{
+			in: ExpressionOrList{
 				Expression: "true",
 			},
 			out: "true",
 		},
 		{
 			name: "all",
-			in: Config{
+			in: ExpressionOrList{
 				All: []string{"true"},
 			},
 			out: "( true )",
 		},
 		{
 			name: "all with &&",
-			in: Config{
+			in: ExpressionOrList{
 				All: []string{"true", "true"},
 			},
 			out: "( true ) && ( true )",
 		},
 		{
 			name: "any",
-			in: Config{
+			in: ExpressionOrList{
 				All: []string{"true"},
 			},
 			out: "( true )",
 		},
 		{
 			name: "any with ||",
-			in: Config{
+			in: ExpressionOrList{
 				Any: []string{"true", "true"},
 			},
 			out: "( true ) || ( true )",

lib/policy/config/threshold.go

@@ -5,7 +5,6 @@ import (
 	"fmt"
 
 	"github.com/TecharoHQ/anubis"
-	"github.com/TecharoHQ/anubis/lib/checker/expression"
 )
 
 var (
@@ -18,7 +17,7 @@ var (
 	DefaultThresholds = []Threshold{
 		{
 			Name: "legacy-anubis-behaviour",
-			Expression: &expression.Config{
+			Expression: &ExpressionOrList{
 				Expression: "weight > 0",
 			},
 			Action: RuleChallenge,
@@ -32,10 +31,10 @@ var (
 )
 
 type Threshold struct {
-	Name       string             `json:"name" yaml:"name"`
-	Expression *expression.Config `json:"expression" yaml:"expression"`
-	Action     Rule               `json:"action" yaml:"action"`
-	Challenge  *ChallengeRules    `json:"challenge" yaml:"challenge"`
+	Name       string            `json:"name" yaml:"name"`
+	Expression *ExpressionOrList `json:"expression" yaml:"expression"`
+	Action     Rule              `json:"action" yaml:"action"`
+	Challenge  *ChallengeRules   `json:"challenge" yaml:"challenge"`
 }
 
 func (t Threshold) Valid() error {

lib/policy/config/threshold_test.go

@@ -6,8 +6,6 @@ import (
 	"os"
 	"path/filepath"
 	"testing"
-
-	"github.com/TecharoHQ/anubis/lib/checker/expression"
 )
 
 func TestThresholdValid(t *testing.T) {
@@ -20,7 +18,7 @@ func TestThresholdValid(t *testing.T) {
 			name: "basic allow",
 			input: &Threshold{
 				Name:       "basic-allow",
-				Expression: &expression.Config{Expression: "true"},
+				Expression: &ExpressionOrList{Expression: "true"},
 				Action:     RuleAllow,
 			},
 			err: nil,
@@ -29,7 +27,7 @@ func TestThresholdValid(t *testing.T) {
 			name: "basic challenge",
 			input: &Threshold{
 				Name:       "basic-challenge",
-				Expression: &expression.Config{Expression: "true"},
+				Expression: &ExpressionOrList{Expression: "true"},
 				Action:     RuleChallenge,
 				Challenge: &ChallengeRules{
 					Algorithm:  "fast",
@@ -52,9 +50,9 @@ func TestThresholdValid(t *testing.T) {
 		{
 			name: "invalid expression",
 			input: &Threshold{
-				Expression: &expression.Config{},
+				Expression: &ExpressionOrList{},
 			},
-			err: expression.ErrExpressionEmpty,
+			err: ErrExpressionEmpty,
 		},
 		{
 			name:  "invalid action",

lib/policy/expressions/environment.go

@@ -1,4 +1,4 @@
-package environment
+package expressions
 
 import (
 	"math/rand/v2"
@@ -10,11 +10,11 @@ import (
 	"github.com/google/cel-go/ext"
 )
 
-// Bot creates a new CEL environment, this is the set of variables and
-// functions that are passed into the CEL scope so that Anubis can fail
-// loudly and early when something is invalid instead of blowing up at
-// runtime.
-func Bot() (*cel.Env, error) {
+// BotEnvironment creates a new CEL environment, this is the set of
+// variables and functions that are passed into the CEL scope so that
+// Anubis can fail loudly and early when something is invalid instead
+// of blowing up at runtime.
+func BotEnvironment() (*cel.Env, error) {
 	return New(
 		// Variables exposed to CEL programs:
 		cel.Variable("remoteAddress", cel.StringType),
@@ -57,14 +57,13 @@ func Bot() (*cel.Env, error) {
 	)
 }
 
-// Threshold creates a new CEL environment for threshold checking.
-func Threshold() (*cel.Env, error) {
+// NewThreshold creates a new CEL environment for threshold checking.
+func ThresholdEnvironment() (*cel.Env, error) {
 	return New(
 		cel.Variable("weight", cel.IntType),
 	)
 }
 
-// New creates a new base CEL environment.
 func New(opts ...cel.EnvOption) (*cel.Env, error) {
 	args := []cel.EnvOption{
 		ext.Strings(
@@ -96,7 +95,7 @@ func New(opts ...cel.EnvOption) (*cel.Env, error) {
 	return cel.NewEnv(args...)
 }
 
-// Compile takes a CEL environment and syntax tree then emits an optimized
+// Compile takes CEL environment and syntax tree then emits an optimized
 // Program for execution.
 func Compile(env *cel.Env, src string) (cel.Program, error) {
 	intermediate, iss := env.Compile(src)

lib/policy/expressions/environment_test.go

@@ -1,4 +1,4 @@
-package environment
+package expressions
 
 import (
 	"testing"
@@ -6,8 +6,8 @@ import (
 	"github.com/google/cel-go/common/types"
 )
 
-func TestBot(t *testing.T) {
-	env, err := Bot()
+func TestBotEnvironment(t *testing.T) {
+	env, err := BotEnvironment()
 	if err != nil {
 		t.Fatalf("failed to create bot environment: %v", err)
 	}
@@ -108,8 +108,8 @@ func TestBot(t *testing.T) {
 	})
 }
 
-func TestThreshold(t *testing.T) {
-	env, err := Threshold()
+func TestThresholdEnvironment(t *testing.T) {
+	env, err := ThresholdEnvironment()
 	if err != nil {
 		t.Fatalf("failed to create threshold environment: %v", err)
 	}

lib/policy/expressions/http_headers.go

@@ -1,4 +1,4 @@
-package expression
+package expressions
 
 import (
 	"net/http"

lib/policy/expressions/http_headers_test.go

@@ -1,4 +1,4 @@
-package expression
+package expressions
 
 import (
 	"net/http"

lib/policy/expressions/loadavg.go

@@ -1,4 +1,4 @@
-package expression
+package expressions
 
 import (
 	"context"

lib/policy/expressions/url_values.go

@@ -1,4 +1,4 @@
-package expression
+package expressions
 
 import (
 	"errors"

lib/policy/expressions/url_values_test.go

@@ -1,4 +1,4 @@
-package expression
+package expressions
 
 import (
 	"net/url"

lib/policy/policy.go

@@ -8,14 +8,10 @@ import (
 	"log/slog"
 	"sync/atomic"
 
-	"github.com/TecharoHQ/anubis/lib/checker"
-	"github.com/TecharoHQ/anubis/lib/checker/expression"
-	"github.com/TecharoHQ/anubis/lib/checker/headermatches"
-	"github.com/TecharoHQ/anubis/lib/checker/path"
-	"github.com/TecharoHQ/anubis/lib/checker/remoteaddress"
+	"github.com/TecharoHQ/anubis/internal/thoth"
+	"github.com/TecharoHQ/anubis/lib/policy/checker"
 	"github.com/TecharoHQ/anubis/lib/policy/config"
 	"github.com/TecharoHQ/anubis/lib/store"
-	"github.com/TecharoHQ/anubis/lib/thoth"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/promauto"
 
@@ -77,10 +73,10 @@ func ParseConfig(ctx context.Context, fin io.Reader, fname string, defaultDiffic
 			Action: b.Action,
 		}
 
-		cl := checker.Any{}
+		cl := checker.List{}
 
 		if len(b.RemoteAddr) > 0 {
-			c, err := remoteaddress.New(b.RemoteAddr)
+			c, err := NewRemoteAddrChecker(b.RemoteAddr)
 			if err != nil {
 				validationErrs = append(validationErrs, fmt.Errorf("while processing rule %s remote addr set: %w", b.Name, err))
 			} else {
@@ -89,7 +85,7 @@ func ParseConfig(ctx context.Context, fin io.Reader, fname string, defaultDiffic
 		}
 
 		if b.UserAgentRegex != nil {
-			c, err := headermatches.NewUserAgent(*b.UserAgentRegex)
+			c, err := NewUserAgentChecker(*b.UserAgentRegex)
 			if err != nil {
 				validationErrs = append(validationErrs, fmt.Errorf("while processing rule %s user agent regex: %w", b.Name, err))
 			} else {
@@ -98,7 +94,7 @@ func ParseConfig(ctx context.Context, fin io.Reader, fname string, defaultDiffic
 		}
 
 		if b.PathRegex != nil {
-			c, err := path.New(*b.PathRegex)
+			c, err := NewPathChecker(*b.PathRegex)
 			if err != nil {
 				validationErrs = append(validationErrs, fmt.Errorf("while processing rule %s path regex: %w", b.Name, err))
 			} else {
@@ -116,7 +112,7 @@ func ParseConfig(ctx context.Context, fin io.Reader, fname string, defaultDiffic
 		}
 
 		if b.Expression != nil {
-			c, err := expression.New(b.Expression)
+			c, err := NewCELChecker(b.Expression)
 			if err != nil {
 				validationErrs = append(validationErrs, fmt.Errorf("while processing rule %s expressions: %w", b.Name, err))
 			} else {

lib/policy/policy_test.go

@@ -7,7 +7,7 @@ import (
 
 	"github.com/TecharoHQ/anubis"
 	"github.com/TecharoHQ/anubis/data"
-	"github.com/TecharoHQ/anubis/lib/thoth/thothmock"
+	"github.com/TecharoHQ/anubis/internal/thoth/thothmock"
 )
 
 func TestDefaultPolicyMustParse(t *testing.T) {

lib/policy/thresholds.go

@@ -1,8 +1,8 @@
 package policy
 
 import (
-	"github.com/TecharoHQ/anubis/lib/checker/expression/environment"
 	"github.com/TecharoHQ/anubis/lib/policy/config"
+	"github.com/TecharoHQ/anubis/lib/policy/expressions"
 	"github.com/google/cel-go/cel"
 )
 
@@ -16,12 +16,12 @@ func ParsedThresholdFromConfig(t config.Threshold) (*Threshold, error) {
 		Threshold: t,
 	}
 
-	env, err := environment.Threshold()
+	env, err := expressions.ThresholdEnvironment()
 	if err != nil {
 		return nil, err
 	}
 
-	program, err := environment.Compile(env, t.Expression.String())
+	program, err := expressions.Compile(env, t.Expression.String())
 	if err != nil {
 		return nil, err
 	}

lib/testdata/permissive.yaml

@@ -1,4 +0,0 @@
-bots:
-  - import: (data)/common/allow-private-addresses.yaml
-
-dnsbl: false

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@techaro/anubis",
-  "version": "1.21.3",
+  "version": "1.21.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@techaro/anubis",
-      "version": "1.21.3",
+      "version": "1.21.1",
       "license": "ISC",
       "devDependencies": {
         "cssnano": "^7.1.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@techaro/anubis",
-  "version": "1.21.3",
+  "version": "1.21.1",
   "description": "",
   "main": "index.js",
   "scripts": {

web/index.go

@@ -25,8 +25,8 @@ func Index(localizer *localization.SimpleLocalizer) templ.Component {
 	return index(localizer)
 }
 
-func ErrorPage(msg, mail string, localizer *localization.SimpleLocalizer) templ.Component {
-	return errorPage(msg, mail, localizer)
+func ErrorPage(msg, mail, redirect string, localizer *localization.SimpleLocalizer) templ.Component {
+	return errorPage(msg, mail, redirect, localizer)
 }
 
 func Bench(localizer *localization.SimpleLocalizer) templ.Component {

web/index.templ

@@ -122,10 +122,18 @@ templ index(localizer *localization.SimpleLocalizer) {
 	</div>
 }
 
-templ errorPage(message, mail string, localizer *localization.SimpleLocalizer) {
+script reload(redirect string) {
+	if (redirect === "") {
+		redirect = "/";
+	}
+	window.location = redirect;
+}
+
+templ errorPage(message, mail, redirect string, localizer *localization.SimpleLocalizer) {
 	<div class="centered-div">
 		<img id="image" alt="Sad Anubis" style="width:100%;max-width:256px;" src={ anubis.BasePrefix + "/.within.website/x/cmd/anubis/static/img/reject.webp?cacheBuster=" + anubis.Version }/>
 		<p>{ message }.</p>
+		<button onClick={ reload(redirect) }>{ localizer.T("try_again") }</button>
 		if mail != "" {
 			<p>
 				<a href="/">{ localizer.T("go_home") }</a> { localizer.T("contact_webmaster") }

web/index_templ.go

@@ -440,7 +440,20 @@ func index(localizer *localization.SimpleLocalizer) templ.Component {
 	})
 }
 
-func errorPage(message, mail string, localizer *localization.SimpleLocalizer) templ.Component {
+func reload(redirect string) templ.ComponentScript {
+	return templ.ComponentScript{
+		Name: `__templ_reload_f48f`,
+		Function: `function __templ_reload_f48f(redirect){if (redirect === "") {
+		redirect = "/";
+	}
+	window.location = redirect;
+}`,
+		Call:       templ.SafeScript(`__templ_reload_f48f`, redirect),
+		CallInline: templ.SafeScriptInline(`__templ_reload_f48f`, redirect),
+	}
+}
+
+func errorPage(message, mail, redirect string, localizer *localization.SimpleLocalizer) templ.Component {
 	return templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
 		templ_7745c5c3_W, ctx := templ_7745c5c3_Input.Writer, templ_7745c5c3_Input.Context
 		if templ_7745c5c3_CtxErr := ctx.Err(); templ_7745c5c3_CtxErr != nil {
@@ -468,7 +481,7 @@ func errorPage(message, mail string, localizer *localization.SimpleLocalizer) te
 		var templ_7745c5c3_Var28 string
 		templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.JoinStringErrs(anubis.BasePrefix + "/.within.website/x/cmd/anubis/static/img/reject.webp?cacheBuster=" + anubis.Version)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 127, Col: 181}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 134, Col: 181}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var28))
 		if templ_7745c5c3_Err != nil {
@@ -481,7 +494,7 @@ func errorPage(message, mail string, localizer *localization.SimpleLocalizer) te
 		var templ_7745c5c3_Var29 string
 		templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.JoinStringErrs(message)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 128, Col: 14}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 135, Col: 14}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var29))
 		if templ_7745c5c3_Err != nil {
@@ -491,83 +504,113 @@ func errorPage(message, mail string, localizer *localization.SimpleLocalizer) te
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
+		templ_7745c5c3_Err = templ.RenderScriptItems(ctx, templ_7745c5c3_Buffer, reload(redirect))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "<button onClick=\"")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var30 templ.ComponentScript = reload(redirect)
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var30.Call)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "\">")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var31 string
+		templ_7745c5c3_Var31, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("try_again"))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 136, Col: 65}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var31))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, "</button> ")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
 		if mail != "" {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "<p><a href=\"/\">")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 40, "<p><a href=\"/\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var30 string
-			templ_7745c5c3_Var30, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("go_home"))
+			var templ_7745c5c3_Var32 string
+			templ_7745c5c3_Var32, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("go_home"))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 131, Col: 40}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var30))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "</a> ")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var31 string
-			templ_7745c5c3_Var31, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("contact_webmaster"))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 131, Col: 81}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var31))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, " <a href=\"")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var32 templ.SafeURL
-			templ_7745c5c3_Var32, templ_7745c5c3_Err = templ.JoinURLErrs("mailto:" + templ.SafeURL(mail))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 132, Col: 45}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 139, Col: 40}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var32))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 40, "\">")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 41, "</a> ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var33 string
-			templ_7745c5c3_Var33, templ_7745c5c3_Err = templ.JoinStringErrs(mail)
+			templ_7745c5c3_Var33, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("contact_webmaster"))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 133, Col: 11}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 139, Col: 81}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var33))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 41, "</a></p>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 42, " <a href=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 42, "<p><a href=\"/\">")
+			var templ_7745c5c3_Var34 templ.SafeURL
+			templ_7745c5c3_Var34, templ_7745c5c3_Err = templ.JoinURLErrs("mailto:" + templ.SafeURL(mail))
 			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var34 string
-			templ_7745c5c3_Var34, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("go_home"))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 137, Col: 42}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 140, Col: 45}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var34))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 43, "</a></p>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 43, "\">")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var35 string
+			templ_7745c5c3_Var35, templ_7745c5c3_Err = templ.JoinStringErrs(mail)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 141, Col: 11}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var35))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 44, "</a></p>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		} else {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 45, "<p><a href=\"/\">")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var36 string
+			templ_7745c5c3_Var36, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("go_home"))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 145, Col: 42}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var36))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 46, "</a></p>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 44, "</div>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 47, "</div>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -591,39 +634,39 @@ func StaticHappy(localizer *localization.SimpleLocalizer) templ.Component {
 			}()
 		}
 		ctx = templ.InitializeContext(ctx)
-		templ_7745c5c3_Var35 := templ.GetChildren(ctx)
-		if templ_7745c5c3_Var35 == nil {
-			templ_7745c5c3_Var35 = templ.NopComponent
+		templ_7745c5c3_Var37 := templ.GetChildren(ctx)
+		if templ_7745c5c3_Var37 == nil {
+			templ_7745c5c3_Var37 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 45, "<div class=\"centered-div\"><img style=\"display:none;\" style=\"width:100%;max-width:256px;\" src=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 48, "<div class=\"centered-div\"><img style=\"display:none;\" style=\"width:100%;max-width:256px;\" src=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		var templ_7745c5c3_Var36 string
-		templ_7745c5c3_Var36, templ_7745c5c3_Err = templ.JoinStringErrs("/.within.website/x/cmd/anubis/static/img/happy.webp?cacheBuster=" +
+		var templ_7745c5c3_Var38 string
+		templ_7745c5c3_Var38, templ_7745c5c3_Err = templ.JoinStringErrs("/.within.website/x/cmd/anubis/static/img/happy.webp?cacheBuster=" +
 			anubis.Version)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 148, Col: 18}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 156, Col: 18}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var36))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var38))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 46, "\"><p>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 49, "\"><p>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		var templ_7745c5c3_Var37 string
-		templ_7745c5c3_Var37, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("static_check_endpoint"))
+		var templ_7745c5c3_Var39 string
+		templ_7745c5c3_Var39, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("static_check_endpoint"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 150, Col: 43}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 158, Col: 43}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var37))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var39))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 47, "</p></div>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 50, "</p></div>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -647,181 +690,181 @@ func bench(localizer *localization.SimpleLocalizer) templ.Component {
 			}()
 		}
 		ctx = templ.InitializeContext(ctx)
-		templ_7745c5c3_Var38 := templ.GetChildren(ctx)
-		if templ_7745c5c3_Var38 == nil {
-			templ_7745c5c3_Var38 = templ.NopComponent
+		templ_7745c5c3_Var40 := templ.GetChildren(ctx)
+		if templ_7745c5c3_Var40 == nil {
+			templ_7745c5c3_Var40 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 48, "<div style=\"height:20rem;display:flex\"><table style=\"margin-top:1rem;display:grid;grid-template:auto 1fr/auto auto;gap:0 0.5rem\"><thead style=\"border-bottom:1px solid black;padding:0.25rem 0;display:grid;grid-template:1fr/subgrid;grid-column:1/-1\"><tr id=\"table-header\" style=\"display:contents\"><th style=\"width:4.5rem\">")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		var templ_7745c5c3_Var39 string
-		templ_7745c5c3_Var39, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("time"))
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 161, Col: 51}
-		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var39))
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 49, "</th><th style=\"width:4rem\">")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		var templ_7745c5c3_Var40 string
-		templ_7745c5c3_Var40, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("iters"))
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 162, Col: 50}
-		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var40))
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 50, "</th></tr><tr id=\"table-header-compare\" style=\"display:none\"><th style=\"width:4.5rem\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 51, "<div style=\"height:20rem;display:flex\"><table style=\"margin-top:1rem;display:grid;grid-template:auto 1fr/auto auto;gap:0 0.5rem\"><thead style=\"border-bottom:1px solid black;padding:0.25rem 0;display:grid;grid-template:1fr/subgrid;grid-column:1/-1\"><tr id=\"table-header\" style=\"display:contents\"><th style=\"width:4.5rem\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var41 string
-		templ_7745c5c3_Var41, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("time_a"))
+		templ_7745c5c3_Var41, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("time"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 165, Col: 53}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 169, Col: 51}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var41))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 51, "</th><th style=\"width:4rem\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 52, "</th><th style=\"width:4rem\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var42 string
-		templ_7745c5c3_Var42, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("iters_a"))
+		templ_7745c5c3_Var42, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("iters"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 166, Col: 52}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 170, Col: 50}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var42))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 52, "</th><th style=\"width:4.5rem\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 53, "</th></tr><tr id=\"table-header-compare\" style=\"display:none\"><th style=\"width:4.5rem\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var43 string
-		templ_7745c5c3_Var43, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("time_b"))
+		templ_7745c5c3_Var43, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("time_a"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 167, Col: 53}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 173, Col: 53}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var43))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 53, "</th><th style=\"width:4rem\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 54, "</th><th style=\"width:4rem\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var44 string
-		templ_7745c5c3_Var44, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("iters_b"))
+		templ_7745c5c3_Var44, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("iters_a"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 168, Col: 52}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 174, Col: 52}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var44))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 54, "</th></tr></thead> <tbody id=\"results\" style=\"padding-top:0.25rem;display:grid;grid-template-columns:subgrid;grid-auto-rows:min-content;grid-column:1/-1;row-gap:0.25rem;overflow-y:auto;font-variant-numeric:tabular-nums\"></tbody></table><div class=\"centered-div\"><img id=\"image\" style=\"width:100%;max-width:256px;\" src=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 55, "</th><th style=\"width:4.5rem\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var45 string
-		templ_7745c5c3_Var45, templ_7745c5c3_Err = templ.JoinStringErrs(anubis.BasePrefix + "/.within.website/x/cmd/anubis/static/img/pensive.webp?cacheBuster=" + anubis.Version)
+		templ_7745c5c3_Var45, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("time_b"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 177, Col: 166}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 175, Col: 53}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var45))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 55, "\"><p id=\"status\" style=\"max-width:256px\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 56, "</th><th style=\"width:4rem\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var46 string
-		templ_7745c5c3_Var46, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("loading"))
+		templ_7745c5c3_Var46, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("iters_b"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 178, Col: 66}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 176, Col: 52}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var46))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 56, "</p><script async type=\"module\" src=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 57, "</th></tr></thead> <tbody id=\"results\" style=\"padding-top:0.25rem;display:grid;grid-template-columns:subgrid;grid-auto-rows:min-content;grid-column:1/-1;row-gap:0.25rem;overflow-y:auto;font-variant-numeric:tabular-nums\"></tbody></table><div class=\"centered-div\"><img id=\"image\" style=\"width:100%;max-width:256px;\" src=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var47 string
-		templ_7745c5c3_Var47, templ_7745c5c3_Err = templ.JoinStringErrs(anubis.BasePrefix + "/.within.website/x/cmd/anubis/static/js/bench.mjs?cacheBuster=" + anubis.Version)
+		templ_7745c5c3_Var47, templ_7745c5c3_Err = templ.JoinStringErrs(anubis.BasePrefix + "/.within.website/x/cmd/anubis/static/img/pensive.webp?cacheBuster=" + anubis.Version)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 179, Col: 138}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 185, Col: 166}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var47))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 57, "\"></script><div id=\"sparkline\"></div><noscript><p>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 58, "\"><p id=\"status\" style=\"max-width:256px\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var48 string
-		templ_7745c5c3_Var48, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("benchmark_requires_js"))
+		templ_7745c5c3_Var48, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("loading"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 182, Col: 45}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 186, Col: 66}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var48))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 58, "</p></noscript></div></div><form id=\"controls\" style=\"position:fixed;top:0.5rem;right:0.5rem\"><div style=\"display:flex;justify-content:end\"><label for=\"difficulty-input\" style=\"margin-right:0.5rem\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 59, "</p><script async type=\"module\" src=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var49 string
-		templ_7745c5c3_Var49, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("difficulty"))
+		templ_7745c5c3_Var49, templ_7745c5c3_Err = templ.JoinStringErrs(anubis.BasePrefix + "/.within.website/x/cmd/anubis/static/js/bench.mjs?cacheBuster=" + anubis.Version)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 188, Col: 88}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 187, Col: 138}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var49))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 59, "</label> <input id=\"difficulty-input\" type=\"number\" name=\"difficulty\" style=\"width:3rem\"></div><div style=\"margin-top:0.25rem;display:flex;justify-content:end\"><label for=\"algorithm-select\" style=\"margin-right:0.5rem\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 60, "\"></script><div id=\"sparkline\"></div><noscript><p>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var50 string
-		templ_7745c5c3_Var50, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("algorithm"))
+		templ_7745c5c3_Var50, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("benchmark_requires_js"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 192, Col: 87}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 190, Col: 45}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var50))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 60, "</label> <select id=\"algorithm-select\" name=\"algorithm\"></select></div><div style=\"margin-top:0.25rem;display:flex;justify-content:end\"><label for=\"compare-select\" style=\"margin-right:0.5rem\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 61, "</p></noscript></div></div><form id=\"controls\" style=\"position:fixed;top:0.5rem;right:0.5rem\"><div style=\"display:flex;justify-content:end\"><label for=\"difficulty-input\" style=\"margin-right:0.5rem\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var51 string
-		templ_7745c5c3_Var51, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("compare"))
+		templ_7745c5c3_Var51, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("difficulty"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 196, Col: 83}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 196, Col: 88}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var51))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 61, "</label> <select id=\"compare-select\" name=\"compare\"><option value=\"NONE\">-</option></select></div></form>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 62, "</label> <input id=\"difficulty-input\" type=\"number\" name=\"difficulty\" style=\"width:3rem\"></div><div style=\"margin-top:0.25rem;display:flex;justify-content:end\"><label for=\"algorithm-select\" style=\"margin-right:0.5rem\">")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var52 string
+		templ_7745c5c3_Var52, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("algorithm"))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 200, Col: 87}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var52))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 63, "</label> <select id=\"algorithm-select\" name=\"algorithm\"></select></div><div style=\"margin-top:0.25rem;display:flex;justify-content:end\"><label for=\"compare-select\" style=\"margin-right:0.5rem\">")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var53 string
+		templ_7745c5c3_Var53, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("compare"))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 204, Col: 83}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var53))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 64, "</label> <select id=\"compare-select\" name=\"compare\"><option value=\"NONE\">-</option></select></div></form>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}